Core Rule Set: WordPress's ordinary requests pass by default (closes #235)

Add the ninth change: wordpress.conf switches off, per path and field, each
rule that refused ordinary WordPress 7.1.4 requests. Add the recorded requests,
a test at the defaults and reading bodies, and list WordPress in the README.

Model: opus-5-5

README.md

@@ -173,7 +173,7 @@ does.
   the request have `"action":"forward"`.
 - To see a refusal without banning yourself, run `discriminator` with
   `SWW_MODE=observe` and ask for `/.env`. The request reaches the app.
-  `discriminator`'s log lines have `"would_action":"banned"` and
+  `discriminator`'s log lines have `"would_action":"temporarily_banned"` and
   `"rule_ids":["env-file"]`. A ban you get in `enforce` mode is lifted as
   "Clients and bans" below describes.
 - With `SWW_METRICS_TOKEN` set, this answers with the metrics, from a host on
@@ -221,7 +221,7 @@ account, a key, a token or an alert destination stays off until you give one.
 Every setting the code reads, with its default:
 
 | Variable                                 | Default                                                                                  | What it does                                                                                                                                                                                                                                                    |
-| ---------------------------------------- | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| ---------------------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `SWW_COMMAND`                            | `rproxy`                                                                                 | Which command the image runs, and its health check checks: `rproxy` or `discriminator`.                                                                                                                                                                         |
 | `SWRP_WAF_BACKEND`                       | required                                                                                 | `discriminator`'s URL, such as `http://discriminator:8080`.                                                                                                                                                                                                     |
 | `SWRP_UPSTREAM_URL`                      | `http://127.0.0.1:8081`                                                                  | The app's URL: a scheme, a host and an optional port, nothing more.                                                                                                                                                                                             |
@@ -265,6 +265,7 @@ Every setting the code reads, with its default:
 | `SWW_TAG_LISTS`                          | empty                                                                                    | Address lists that each add a tag to their clients' requests, as `name=URL` pairs, such as `torexit=https://example.com/tor.txt`.                                                                                                                               |
 | `SWW_TAG_DENY`                           | empty                                                                                    | Tags whose requests are refused, such as `torexit,country=CN`.                                                                                                                                                                                                  |
 | `SWW_TAG_LIMIT_PERCENT`                  | empty                                                                                    | Tags whose clients get a percentage, from 1 to 99, of every request and byte limit, such as `vpn:50,asn=14061:25`; the lowest applies.                                                                                                                          |
+| `SWW_ROUTEWATCH_URL`                     | unset                                                                                    | The URL of a routewatch instance, which gives each client's `asn=` and `prefix=` tags. Unset, nothing asks routewatch.                                                                                                                                          |
 | `SWW_ASN_BYTES_PERCENT`                  | empty                                                                                    | A percentage of the byte limits alone for the AS numbers listed, in place of their `asn=` tag's percentage.                                                                                                                                                     |
 | `SWW_COUNTRY_BYTES_PERCENT`              | empty                                                                                    | A percentage of the byte limits alone for the countries listed, in place of their `country=` tag's percentage.                                                                                                                                                  |
 | `SWW_UNKNOWN_LIMIT_PERCENT`              | `100`                                                                                    | The percentage of every limit a client without a country gets.                                                                                                                                                                                                  |
@@ -310,7 +311,7 @@ Every setting the code reads, with its default:
 | `SWW_ALERT_SLACK_WEBHOOK_URL`            | unset                                                                                    | A Slack incoming webhook each alert is posted to as a message.                                                                                                                                                                                                  |
 | `SWW_ALERT_NTFY_URL`                     | unset                                                                                    | An ntfy topic each alert is published to, as its full URL, such as `https://ntfy.sh/my-alerts`.                                                                                                                                                                 |
 | `SWW_ALERT_NTFY_TOKEN`                   | unset                                                                                    | An ntfy access token sent with each alert.                                                                                                                                                                                                                      |
-| `SWW_ALERT_EVENTS`                       | `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error` | The events alerts are sent for; the hourly `summary` is sent whatever it says.                                                                                                                                                                                  |
+| `SWW_ALERT_EVENTS`                       | `ban,permanent_ban,core_rule_set_match,anomaly,reputation_hit,source_failure,file_error` | The events alerts are sent for; the hourly `summary` is sent whatever it says.                                                                                                                                                                                  |
 | `SWW_ALERT_COOLDOWN`                     | `15m`                                                                                    | How long after an alert its repeats are held back and counted, a duration or `off`.                                                                                                                                                                             |
 | `SWW_ALERT_MAX_PER_HOUR`                 | `60`                                                                                     | The most alerts sent in an hour, a number or `off`; the rest are counted in the hour's `summary`.                                                                                                                                                               |
 | `SWW_ANOMALY_CLIENT_REQUESTS_PER_MINUTE` | `off`                                                                                    | Alert when one client makes more requests than this in a minute, a count.                                                                                                                                                                                       |
@@ -468,7 +469,7 @@ services:
             # Alerts to an ntfy topic, with its token read from a file.
             SWW_ALERT_NTFY_URL: https://ntfy.example/smallwebwaf
             SWW_ALERT_NTFY_TOKEN_FILE: /etc/sww/tokens/ntfy
-            SWW_ALERT_EVENTS: ban,permanent_ban,waf_block,source_failure,file_error
+            SWW_ALERT_EVENTS: ban,permanent_ban,core_rule_set_match,source_failure,file_error
         volumes:
             - discriminator-state:/var/lib/sww
             - /srv/ipinfo:/var/lib/ipinfo:ro
@@ -567,7 +568,9 @@ the `tags` field of its log line:
   or `vpn=mullvad`;
 - `crowdsec`, `dnsbl=<zone>` and `abuseipdb`, when that reputation source lists
   the client;
-- `exploitsignature`, when a rule file or the Core Rule Set matched the request.
+- `exploitsignature`, when a rule file or the Core Rule Set matched the request;
+- `asn=<number>` and `prefix=<netblock>`, from a routewatch instance, while
+  `SWW_ROUTEWATCH_URL` is set.
 
 `SWW_TAG_DENY` refuses requests by tag, and `SWW_TAG_LIMIT_PERCENT` lowers a
 client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
@@ -578,11 +581,17 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
   headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
   front of a code forge, bodies carry what people write and publish, which the
   rules take for attacks.
-- `smallwebwaf` changes the Core Rule Set in eight ways so that it lets ordinary
+- `smallwebwaf` changes the Core Rule Set in nine ways so that ordinary requests
-  requests to a code forge through, such as git over HTTP and sign-in through
+  get through to a code forge and to WordPress. They include git over HTTP and
-  Git Credential Manager. On gitea's own paths, its searches, file names and
+  sign-in through Git Credential Manager on a code forge, and saving a post from
-  branch names get through too. No setting undoes the changes; "Attack
+  the block editor on WordPress. On gitea's own paths, its searches, file names
-  detection" in [`SPEC.md`](SPEC.md) lists them.
+  and branch names get through too. On WordPress's own paths, its searches and
+  file names do. No setting undoes the changes; "Attack detection" in
+  [`SPEC.md`](SPEC.md) lists them.
+- These apps work out of the box at the default settings, and the Core Rule Set
+  refuses none of their ordinary requests:
+    - gitea;
+    - WordPress.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
   fields or paths.
 - Rule files are plain text, one rule to a line, edited by hand and read again
@@ -629,9 +638,10 @@ is set aside as `<name>.bad`, and never stops the running process (see
 - `internal/rproxy`: the reverse proxy in front of one app.
 - `internal/discriminator`: `discriminator`'s server, which runs the checks and
   answers its own endpoints.
-- `internal/ratelimit`, `internal/bans`, `internal/rules`, `internal/waf`,
+- `internal/ratelimit`, `internal/bans`, `internal/rules`,
-  `internal/lookup`, `internal/reputation`, `internal/anomaly` and
+  `internal/coreruleset`, `internal/lookup`, `internal/reputation`,
-  `internal/alerts`: one check or source each.
+  `internal/routewatch`, `internal/anomaly` and `internal/alerts`: one check or
+  source each.
 - `internal/state`, `internal/requestlog`, `internal/remotelog` and
   `internal/metrics`: the state files, the log lines, the syslog sender and the
   metrics.

SPEC.md

@@ -81,12 +81,14 @@ to them.
       of bans is full.
     - `internal/rules`: reads the rule files at start and again when they
       change, and tells which rules a request matches.
-    - `internal/waf`: the Core Rule Set, with the eight changes listed under
+    - `internal/coreruleset`: the Core Rule Set, with the nine changes listed
-      "Attack detection", as Coraza directives.
+      under "Attack detection", as Coraza directives.
     - `internal/lookup`: looks clients up through GeoJS or in the lookup
       database.
     - `internal/reputation`: fetches the lists, asks the DNS blocklists and
       AbuseIPDB in the background, and keeps their answers.
+    - `internal/routewatch`: asks a routewatch instance about clients in the
+      background, and keeps its answers.
     - `internal/anomaly`: the anomaly counters and their alerts.
     - `internal/alerts`: holds back repeats and alerts past the hourly limit,
       and sends the rest to the webhook, Slack and ntfy, each from a queue of
@@ -144,7 +146,9 @@ request log's `heuristic` field gives that name. `refusal_limit` and
       around its address, a /64 by default, since one abuser usually controls a
       whole /64. A client is therefore one IPv4 address or one IPv6 group.
 3. The tag lists (`tag_lists`; see "Request tags"). Each list that holds the
-   client adds its tag. A client in `SWW_ALLOW_NETS` gets no tag.
+   client adds its tag. Next, `routewatch_tags` adds the client's `asn=` and
+   `prefix=` tags while `SWW_ROUTEWATCH_URL` is set. A client in
+   `SWW_ALLOW_NETS` gets no tag.
 4. The static lists. A client in `SWW_ALLOW_NETS` skips steps 5 to 15, the byte
    limits and the error burst. A client in `SWW_DENY_NETS` is refused
    (`deny_nets`); a client in both lists is let through.
@@ -317,6 +321,13 @@ ban is dropped alike. A scanner whose ban was dropped that way is refused and
 banned again by its next probe. A ban whose cause is `admin` is never dropped
 and does not count toward `SWW_MAX_BANS`, so such bans can never fill the table.
 
+A request refused under a ban that runs out is logged with the action
+`temporarily_banned`. Under a permanent ban the action is `permanently_banned`.
+A request refused for a clear sign of attack or a CrowdSec decision takes the
+action for the ban it made. A request that makes a ban permanent is logged as
+`permanently_banned`. A request over a rate limit is logged as
+`client_is_rate_limited`, whichever ban it makes.
+
 ## Settings
 
 `docs/settings.md` lists every setting with its default and the values it takes,
@@ -554,6 +565,21 @@ Each tag and where it comes from:
 - `exploitsignature`, when a rule file or the Core Rule Set matched the request.
   For the Core Rule Set a match is a score at or over
   `SWW_WAF_ANOMALY_THRESHOLD`.
+- `asn=<number>` and `prefix=<netblock>` from a routewatch instance
+  (`routewatch_tags`), while `SWW_ROUTEWATCH_URL` is set:
+    - The tag `prefix=` holds the netblock the client's address is announced in,
+      such as `prefix=192.0.2.0/24`.
+    - An `asn=` tag has the same spelling as the lookup's. When routewatch and
+      the lookup give the same AS number, a request has one `asn=` tag. When
+      they differ, it has both.
+    - They are added before `deny_nets`, so the log line of a request it refused
+      has them.
+    - `discriminator` asks routewatch in the background and never waits for it.
+      An answer is kept for 1 hour, in memory only.
+    - After a query fails, routewatch is not asked for 1 minute.
+    - A request without these tags gives the reason in the log field
+      `routewatch_tags_missing` (see
+      [`docs/request-log.md`](docs/request-log.md)).
 
 A client in `SWW_ALLOW_NETS` skips the checks and gets no tag. Every tag is in
 lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and
@@ -561,9 +587,10 @@ lower case, except a country code, which is in capitals. `SWW_TAG_DENY` and
 
 Two settings act on tags:
 
-- `SWW_TAG_DENY` lists tags whose requests are refused with the action `denied`
+- `SWW_TAG_DENY` lists tags whose requests are refused with the action
-  (`tag_deny`). The check runs twice: just before the rate limits, and again
+  `client_denied` (`tag_deny`). The check runs twice: just before the rate
-  after the Core Rule Set, so that `exploitsignature` can refuse too.
+  limits, and again after the Core Rule Set, so that `exploitsignature` can
+  refuse too.
 - `SWW_TAG_LIMIT_PERCENT` lists tags with a percentage from 1 to 99. Their
   clients get that percentage of every request and byte limit. The lowest
   percentage among a client's tags applies. `exploitsignature` cannot be listed,
@@ -571,7 +598,9 @@ Two settings act on tags:
 
 The tag settings are empty by default, for the same reason as the country list.
 The lookup waits for GeoJS when either names an `asn=` or `country=` tag. A
-setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`.
+setting that names one stops the start while `SWW_LOOKUP_SOURCE` is `off`. The
+exception is an `asn=` tag while `SWW_ROUTEWATCH_URL` is set, since routewatch
+gives that tag.
 
 ### Biased thresholds
 
@@ -626,7 +655,7 @@ files, the limits and the bans still apply to the client that sends it.
   match, and scores are still logged. A request with more than 1000 query
   parameters or body fields adds 5 to its score, since Coraza reads only the
   first 1000. For a match, in `block` and `detect` mode alike, the log line
-  gives the rule ids and the score, and a `waf_block` alert is sent.
+  gives the rule ids and the score, and a `core_rule_set_match` alert is sent.
 - `SWW_WAF_DISABLED_RULES` switches off rule ids when an app trips a false
   positive. The default switches off six rules:
     - 920340, 920420 and 920640 refuse a request for the type of its body, when
@@ -645,7 +674,8 @@ files, the limits and the bans still apply to the client that sends it.
 - `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
   Coraza directives. An exclusion switches one rule off for some fields or paths
   only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
-  holds an app's own exclusions; the eighth change below holds gitea's.
+  holds an app's own exclusions; the eighth and ninth changes below hold gitea's
+  and WordPress's.
     - `discriminator` loads the file after `smallwebwaf`'s own setup rules and
       before the Core Rule Set's rules. The Core Rule Set loads its own
       `REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
@@ -691,9 +721,9 @@ files, the limits and the bans still apply to the client that sends it.
     scanner from an ordinary client. In front of a code forge, registry and git
     clients get `404` and `401` by design, hundreds of times a minute.
 
-`smallwebwaf` changes the Core Rule Set 4.25.0 in eight ways, since in front of
+`smallwebwaf` changes the Core Rule Set 4.25.0 in nine ways, since in front of
-gitea it would otherwise refuse ordinary requests. The changes hold in front of
+gitea and WordPress it would otherwise refuse ordinary requests. The changes
-every app, and no setting undoes them:
+hold in front of every app, and no setting undoes them:
 
 1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
    and `OPTIONS`. APIs, container image pushes and package uploads use them.
@@ -760,8 +790,8 @@ every app, and no setting undoes them:
    such as `owner/python3-app` would have that push refused.
 8. On gitea's paths, some fields skip the rules that refused ordinary gitea
    requests there. They are the fields where gitea sends a search, a file name
-   or a branch name. `internal/waf/gitea.conf` lists each rule and the request
+   or a branch name. `internal/coreruleset/gitea.conf` lists each rule and the
-   it refused. The fields are:
+   request it refused. The fields are:
     - `q` on gitea's searches of code, of issues and pull requests, and of
       commits. A code search holds code, such as `<script>`,
       `SELECT * FROM users WHERE` or `../`.
@@ -818,6 +848,77 @@ every app, and no setting undoes them:
     site root. An app other than gitea that serves one of them must check these
     fields itself.
 
+9. On WordPress's paths, some fields skip the rules that refused ordinary
+   WordPress requests there. `internal/coreruleset/wordpress.conf` lists each
+   rule and the request it refused. The REST API has four addresses:
+    - `/wp-json/...`
+    - `/index.php/wp-json/...`
+    - `/index.php?rest_route=/...`
+    - `/?rest_route=/...`
+
+    The fields are:
+    - The header `X-HTTP-Method-Override` on any address of the REST API
+      (920450). The block editor saves a post with `POST` and names `PUT` in
+      this header.
+    - `s` in WordPress's searches, for the lists of system files and command
+      names (930120, 932120, 932250, 932260). The pages are:
+        - `/` and `/index.php`;
+        - `/page/N/` and `/index.php/page/N/`, the later pages of a search;
+        - `/wp-admin/edit.php`;
+        - `/wp-admin/upload.php`;
+        - `/wp-admin/plugin-install.php`.
+    - `s` in the other searches of `wp-admin`, for the lists of command names
+      (932120, 932250, 932260). The pages are:
+        - `/wp-admin/edit-comments.php`;
+        - `/wp-admin/users.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/edit-tags.php`.
+    - `search` on every REST API route under `/wp/v2/`, for the lists of system
+      files and command names (930120, 932120, 932250, 932260).
+    - `search` in the searches of themes and of the media grid, for the lists of
+      command names (932120, 932250, 932260). The pages are:
+        - `/wp-admin/themes.php`;
+        - `/wp-admin/theme-install.php`;
+        - `/wp-admin/upload.php`.
+    - `q` and `term` on `/wp-admin/admin-ajax.php`, for the lists of command
+      names (932120, 932250, 932260). They carry the classic editor's tag field
+      and the search for a user to add.
+    - `term` on the REST API's route `/wp/v2/block-directory/search`, for the
+      same rules.
+    - `_wp_http_referer`, which holds the page's own address and so repeats the
+      last search, for the lists of system files and command names (930120,
+      932120, 932235, 932250, 932260, 932340). The pages are:
+        - `/wp-admin/edit.php`;
+        - `/wp-admin/edit-comments.php`;
+        - `/wp-admin/edit-tags.php`;
+        - `/wp-admin/plugin-install.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/theme-install.php`;
+        - `/wp-admin/themes.php`;
+        - `/wp-admin/upload.php`;
+        - `/wp-admin/users.php`.
+    - `tag` on `/`, `/index.php` and `/wp-admin/edit.php`, for the lists of
+      command names (932120, 932250, 932260).
+    - `category_name` on `/wp-admin/edit.php`, for the same rules.
+    - `file` on `/wp-admin/plugin-editor.php` and `/wp-admin/theme-editor.php`,
+      for the lists of system files, shell paths, command names and JavaScript
+      names (930120, 932120, 932160, 932260, 941180).
+    - `plugin`, for the lists of command names (932120, 932260). The pages are:
+        - `/wp-admin/plugin-editor.php`;
+        - `/wp-admin/plugins.php`;
+        - `/wp-admin/update.php`.
+    - These fields of a body. Each applies only when the query has no parameter
+      of that name, so it matters only while `SWW_WAF_BODY_LIMIT` is set:
+        - `content` of a post, a page, a template or a template part saved
+          through the REST API. It holds HTML and any code it shows.
+        - `content` of a reply to a comment sent to `admin-ajax.php`.
+        - `newcontent` of a plugin's or a theme's file saved from its editor,
+          which is PHP.
+        - `pwd` when signing in, for the list of system files (930120).
+
+    Elsewhere these fields keep every rule. The paths are those of WordPress at
+    the site root.
+
 The parameter and cookie names in these changes are matched without regard to
 case, as Coraza matches them.
 
@@ -1317,9 +1418,9 @@ over either one:
   `Transfer-Encoding` do not count. `X-Request-ID` and `X-Forwarded-Proto` do.
 
 Real clients never reach these limits. The answer is `deny` with `431`, and the
-log line's action is `too_large`. The refusal makes no ban and is no offence.
+log line's action is `request_header_too_large`. The refusal makes no ban and is
-The rate limits count the request as usual, so a client that keeps sending such
+no offence. The rate limits count the request as usual, so a client that keeps
-requests breaks a limit.
+sending such requests breaks a limit.
 
 The limits apply on every path and in every `SWW_WAF_MODE`. A client in
 `SWW_ALLOW_NETS` skips them, as it skips the Core Rule Set. In `observe` mode
@@ -1349,11 +1450,11 @@ these fields, named as the request log's fields of the same meaning:
 - `request_bytes` and `response_bytes`: the body bytes each way, with what a
   WebSocket carried each way, each a whole number from `0` to `1125899906842624`
   (1 PiB);
-- `duration_total`: milliseconds from the request's headers being read to the
+- `duration_total_ms`: milliseconds from the request's headers being read to the
   end of the answer, from `0` to `1000000000000` (about 31 years);
-- `duration_upstream_total`: milliseconds from the hand-over to the app to the
+- `duration_upstream_total_ms`: milliseconds from the hand-over to the app to
-  end of the answer, in the same range, and `0` for a request not passed to the
+  the end of the answer, in the same range, and `0` for a request not passed to
-  app.
+  the app.
 
 `discriminator` answers `400` and writes a process warning when the body:
 

docs/alerts.md

@@ -9,9 +9,9 @@ back or dropped.
 - `ban`: a ban `discriminator` made.
 - `permanent_ban`: a permanent ban it made, or an existing ban made permanent by
   a request.
-- `waf_block`: the Core Rule Set scored a request at or over the threshold. The
+- `core_rule_set_match`: the Core Rule Set scored a request at or over the
-  request was refused unless the alert's `detail` gives `mode`: `detect` or
+  threshold. The request was refused unless the alert's `detail` gives `mode`:
-  `observe`.
+  `detect` or `observe`.
 - `anomaly`: a count over an anomaly threshold.
 - `reputation_hit`: a request from a client on a blocklist, the CrowdSec
   decision list or a DNS blocklist, or with an AbuseIPDB score that is a hit.
@@ -130,7 +130,7 @@ The priority and tag by event:
 
 - `ban`: priority `default`, tag `no_entry`.
 - `permanent_ban`: priority `high`, tag `no_entry`.
-- `waf_block`: priority `default`, tag `shield`.
+- `core_rule_set_match`: priority `default`, tag `shield`.
 - `anomaly`: priority `high`, tag `chart_with_upwards_trend`.
 - `reputation_hit`: priority `low`, tag `label`.
 - `source_failure` and `file_error`: priority `high`, tag `warning`.

docs/metrics.md

@@ -28,7 +28,8 @@ body bytes, never headers, whatever `SWW_BYTES_COUNT` says.
 ## Attack detection
 
 - `sww_rule_matches_total`, by `rule_id` and `action`, and `sww_rules_loaded`;
-- `sww_waf_matches_total`, by `mode` and `rule_id`, for the rules that fired.
+- `sww_core_rule_set_matches_total`, by `mode` and `rule_id`, for the rules that
+  fired.
 
 ## Countries and AS numbers
 
@@ -43,8 +44,8 @@ For the `SWW_METRICS_TOP_N` busiest of each, the rest as `other`:
 ## Lookups
 
 - `sww_geojs_requests_total` and `sww_geojs_failures_total`;
-- `sww_geojs_unanswered_total`: the requests that needed an answer and went on
+- `sww_requests_without_geojs_answer_total`: the requests that needed an answer
-  without it;
+  and went on without it;
 - with the file source, `sww_lookup_database_last_read_timestamp_seconds` and
   `sww_lookup_database_read_failures_total`.
 
@@ -70,8 +71,8 @@ By `file`:
 ## Remote log, alerts and the process
 
 - while a syslog server is set, `sww_remote_log_lines_sent_total`,
-  `sww_remote_log_lines_dropped_total` and `sww_remote_log_buffer_depth`;
+  `sww_remote_log_lines_dropped_total` and `sww_remote_log_lines_waiting`;
-- by `destination`, `sww_alerts_sent_total`, `sww_alerts_failed_total`,
+- by `destination`, `sww_alerts_sent_total`, `sww_alert_send_failures_total`,
   `sww_alerts_suppressed_total` and `sww_alerts_dropped_total`;
 - Go's own `go_` metrics and the process's `process_` metrics.
 

docs/request-log.md

@@ -26,7 +26,7 @@ These questions write no line:
 A `report` line:
 
 ```
-{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"waf_score":0,"duration_total":3.217,"duration_checks":0.041,"duration_waf":0.029,"duration_upstream_total":3.104}
+{"type":"request","discriminator_line":"report","time":"2026-10-03T12:00:00.123Z","instance":"fsn1/discriminator","client_ip":"203.0.113.9","method":"GET","scheme":"https","host":"app.example","path":"/","query":"","protocol":"HTTP/1.1","status":200,"request_bytes":0,"response_bytes":5120,"referer":"","user_agent":"curl/8.9.1","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","peer_ip":"172.18.0.2","forwarded_for":"203.0.113.9","client_group":"203.0.113.9/32","asn":"AS64496","as_name":"Example Net","country":"DE","request_headers":{"accept":"*/*"},"action":"forward","counts":{"minute":1,"hour":12,"day":40,"minute_bytes":5120,"hour_bytes":61440,"day_bytes":204800},"core_rule_set_score":0,"duration_total_ms":3.217,"duration_checks_ms":0.041,"duration_core_rule_set_ms":0.029,"duration_upstream_total_ms":3.104}
 ```
 
 ### Every line
@@ -37,7 +37,7 @@ Every one of these lines has:
 - the standard web log fields;
 - `request_id`, `peer_ip` and `client_group`;
 - `asn`, `as_name` and `country`;
-- `action` and `duration_total`.
+- `action` and `duration_total_ms`.
 
 ### Standard web log fields
 
@@ -96,15 +96,17 @@ Every one of these lines has:
 
 - `action`: what was done:
     - `forward`: answered `allow`, so that `rproxy` passes it to the app;
-    - `denied`: refused for `SWW_DENY_NETS`, for a reputation source with the
+    - `client_denied`: refused for `SWW_DENY_NETS`, for a reputation source with
-      action `deny`, or for a tag in `SWW_TAG_DENY`;
+      the action `deny`, or for a tag in `SWW_TAG_DENY`;
-    - `banned`: refused under a ban, or for a `ban` rule, a trap path or a
+    - `temporarily_banned`: refused under a ban that runs out, or for a `ban`
-      CrowdSec decision, each of which bans the client;
+      rule, a trap path or a CrowdSec decision that made such a ban;
-    - `country_denied`, `rate_limited`, `rule_blocked` and `waf_blocked`:
+    - `permanently_banned`: refused under a ban that never runs out, including a
-      refused by that check;
+      ban this request made or made permanent;
-    - `too_large`: over a header limit;
+    - `country_denied`, `client_is_rate_limited`, `blocked_by_block_rule` and
-    - `admin`: answered at one of `discriminator`'s own endpoints, or `404` for
+      `blocked_by_core_rule_set`: refused by that check;
-      a path under `/_sww/`.
+    - `request_header_too_large`: over a header limit;
+    - `own_endpoint`: answered at one of `discriminator`'s own endpoints, or
+      `404` for a path under `/_sww/`.
 - `would_action`: in `observe` mode, what `enforce` mode would have done with a
   request it would have refused. `action` then names what was done, normally
   `forward`.
@@ -138,9 +140,10 @@ Every one of these lines has:
     `byte_limits` bans when the report comes, so only the `report` line names
     it.
 
-- `limit_percent` and `limit_percent_setting`: the client's percentage of the
+- `rate_limit_percent` and `rate_limit_percent_setting`: the client's percentage
-  rate limits and the setting that lowered it, when one did. `bytes_percent` and
+  of the rate limits and the setting that lowered it, when one did.
-  `bytes_percent_setting` do the same for the byte limits.
+  `bytes_limit_percent` and `bytes_limit_percent_setting` do the same for the
+  byte limits.
 - `counts`: the client's totals as rate limiting counts them, this request
   included. It is left out when rate limiting did not count the request. It
   holds:
@@ -156,7 +159,7 @@ Every one of these lines has:
 - `limit_hit`: the limit broken:
     - `minute`, `hour` or `day` for a rate limit;
     - `minute_bytes`, `hour_bytes` or `day_bytes` for a byte limit;
-    - `error_burst`.
+    - `minute_refusals` for the error burst (`SWW_ERROR_BURST_THRESHOLD`).
 
     When the bytes counted for a request and its response break a limit, the
     request has been passed on whole, so its `action` stays `forward`. Only its
@@ -164,8 +167,8 @@ Every one of these lines has:
 
 - `rule_ids`: the rule file rules that matched, in order, up to the one that
   refused.
-- `waf_score` and `waf_rule_ids`: the Core Rule Set's score and the rules that
+- `core_rule_set_score` and `core_rule_set_rule_ids`: the Core Rule Set's score
-  matched, for a request it inspected.
+  and the rules that matched, for a request it inspected.
 - `reputation`: the sources the client is on, in this order:
     - blocklist URLs;
     - the CrowdSec decision list's URL;
@@ -173,6 +176,12 @@ Every one of these lines has:
     - `abuseipdb`.
 - `tags`: the request's tags, sorted, left out when it has none. Each tag and
   where it comes from is under "Request tags" in [`SPEC.md`](../SPEC.md).
+- `routewatch_tags_missing`: why the request got no tags from routewatch,
+  present only while `SWW_ROUTEWATCH_URL` is set:
+    - `no_answer_yet`: routewatch has not answered about this client yet;
+    - `request_failed`: a query to routewatch failed within the last minute, and
+      the process log says why;
+    - `no_route`: routewatch knows no live route for the address.
 - `offence`: `limit`, for a request that broke a limit.
 - `ban_expires`: when the client's ban ends, for a request that made one or was
   refused under one: a time, or `permanent`.
@@ -181,14 +190,14 @@ Every one of these lines has:
 
 All in milliseconds:
 
-- `duration_total`:
+- `duration_total_ms`:
     - on the `decision` line, from `discriminator` having read the question's
       body to the line;
     - on the `report` line, from `rproxy` having read the request's headers to
       the end of the answer.
-- `duration_checks`: to the end of the checks;
+- `duration_checks_ms`: to the end of the checks;
-- `duration_waf`: the part of that the Core Rule Set took;
+- `duration_core_rule_set_ms`: the part of that the Core Rule Set took;
-- `duration_upstream_total`: on the `report` line of an allowed request, from
+- `duration_upstream_total_ms`: on the `report` line of an allowed request, from
   the hand-over to the app to the end of the answer.
 
 ### Requests to its own endpoints
@@ -201,8 +210,8 @@ these meanings where they differ:
 - `scheme`: `http`.
 - `time`: when the request's headers had been read.
 - `request_bytes`: the bytes read of a ban to add, and otherwise `0`.
-- `action`: `admin`.
+- `action`: `own_endpoint`.
-- `duration_total`: from the request's headers being read to the line.
+- `duration_total_ms`: from the request's headers being read to the line.
 
 ## `rproxy`'s line
 
@@ -220,10 +229,10 @@ these meanings where they differ:
   a WebSocket carried from the visitor.
 - `response_bytes`: the bytes of the answer's body, with what a WebSocket
   carried from the app.
-- `duration_request`: milliseconds from the request's headers being read until
+- `duration_request_ms`: milliseconds from the request's headers being read
-  the app had been sent the whole request, or the answer started if that was
+  until the app had been sent the whole request, or the answer started if that
-  sooner. It includes the wait for `discriminator`.
+  was sooner. It includes the wait for `discriminator`.
-- `duration_response`: milliseconds from then until the end of the answer.
+- `duration_response_ms`: milliseconds from then until the end of the answer.
 - `disposition`: what was done with the request: `allow`, `deny` or `close`. It
   is `discriminator`'s answer, or the value of `SWRP_DEFAULT_DISPOSITION`. It is
   left out when:
@@ -237,5 +246,5 @@ these meanings where they differ:
 For example:
 
 ```
-{"type":"request","time":"2026-10-03T12:00:00.123Z","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","client_ip":"203.0.113.9","host":"app.example","method":"GET","path":"/","query":"","status":200,"request_bytes":0,"response_bytes":5120,"duration_request":1.204,"duration_response":3.104,"disposition":"allow"}
+{"type":"request","time":"2026-10-03T12:00:00.123Z","request_id":"7Q2NHZ4KJ3VXW5YB6R3MEFTD2A","client_ip":"203.0.113.9","host":"app.example","method":"GET","path":"/","query":"","status":200,"request_bytes":0,"response_bytes":5120,"duration_request_ms":1.204,"duration_response_ms":3.104,"disposition":"allow"}
 ```

docs/settings.md

@@ -145,8 +145,8 @@ cut off; the client is banned.
   the start while a setting that needs a lookup is set:
     - `SWW_EXCLUSIVELY_ALLOWED_COUNTRIES`;
     - `SWW_ADD_LOOKUP_HEADERS`;
-    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming an `asn=` or `country=`
+    - `SWW_TAG_DENY` or `SWW_TAG_LIMIT_PERCENT` naming a `country=` tag, or an
-      tag;
+      `asn=` tag while `SWW_ROUTEWATCH_URL` is unset;
     - the two byte percentage lists and `SWW_ASN_LIMIT_PERCENT_URL`;
     - `SWW_UNKNOWN_LIMIT_PERCENT` below `100`;
     - an anomaly threshold per AS number.
@@ -186,11 +186,20 @@ Every request gets tags from what `discriminator` knows of its client. See
   `exploitsignature`: a request gets that tag after the rate limits have counted
   it.
 
+- `SWW_ROUTEWATCH_URL` (default unset): the `http` or `https` URL of a
+  routewatch instance. [routewatch](https://git.eeqj.de/sneak/routewatch) is a
+  service that gives an address's announced netblock and origin AS.
+  `discriminator` asks it about each client, in the background, and adds the
+  tags `asn=<number>` and `prefix=<netblock>` from its answer. While it is
+  unset, nothing asks routewatch and no request gets a `prefix=` tag.
+
 `SWW_TAG_DENY` and `SWW_TAG_LIMIT_PERCENT` accept tags in either case. A tag
 that no request can get stops the start. A request can get only these:
 
 - a name in `SWW_TAG_LISTS`;
 - an `asn=` or `country=` tag;
+- a `prefix=` tag with a netblock, while `SWW_ROUTEWATCH_URL` is set. It matches
+  only that exact announced netblock, such as `prefix=192.0.2.0/24`;
 - a `dnsbl=` tag of a zone in `SWW_DNSBL_ZONES`, in lower case, with a key
   masked as the `reputation` field shows it;
 - `abuseipdb`, while `SWW_ABUSEIPDB_KEY` is set;
@@ -315,7 +324,7 @@ the request first.
 - `SWW_ALERT_NTFY_TOKEN` (default unset): an ntfy access token. A control
   character in it is refused.
 - `SWW_ALERT_EVENTS` (default
-  `ban,permanent_ban,waf_block,anomaly,reputation_hit,source_failure,file_error`):
+  `ban,permanent_ban,core_rule_set_match,anomaly,reputation_hit,source_failure,file_error`):
   the event types alerts are sent for, from those in [`alerts.md`](alerts.md)
   but `summary`. Any other name is refused.
 - `SWW_ALERT_COOLDOWN` (default `15m`): how long after an alert is sent its

docs/state-files.md

@@ -63,8 +63,9 @@ since it was first seen:
 - total requests, and how many were forwarded and how many refused;
 - body bytes of its requests, and of the responses it was sent;
 - responses by status class;
-- offences by kind: `limit`, `attack`, `rule_blocked` and `waf_blocked`. A file
+- offences by kind: `limit`, `attack`, `blocked_by_block_rule` and
-  may also hold `token_refused`, which is kept, and which nothing adds to.
+  `blocked_by_core_rule_set`. A file may also hold `token_refused`, which is
+  kept, and which nothing adds to.
 
 ## `lookups.json`
 

internal/alerts/alerts.go

@@ -44,10 +44,10 @@ const (
 	// EventAnomaly is a count of requests or bytes over an anomaly
 	// threshold.
 	EventAnomaly = "anomaly"
-	// EventWAFBlock is a request the Core Rule Set scored at or over
+	// EventCoreRuleSetMatch is a request the Core Rule Set scored at or over
 	// SWW_WAF_ANOMALY_THRESHOLD, refused in block mode, let through in
 	// detect mode.
-	EventWAFBlock = "waf_block"
+	EventCoreRuleSetMatch = "core_rule_set_match"
 	// EventReputationHit is a request whose client a blocklist, the
 	// CrowdSec decision list or a DNSBL zone lists, or whose AbuseIPDB score
 	// is a hit.
@@ -72,7 +72,7 @@ const (
 // default.
 func Events() []string {
 	return []string{
-		EventBan, EventPermanentBan, EventWAFBlock, EventAnomaly,
+		EventBan, EventPermanentBan, EventCoreRuleSetMatch, EventAnomaly,
 		EventReputationHit, EventSourceFailure, EventFileError,
 	}
 }
@@ -220,7 +220,7 @@ type State struct {
 // requests to it failed, and how many alerts were dropped from its full
 // queue or given up as it refused them.
 type Counts struct {
-	Sent, Failed, Dropped int64
+	Sent, SendFailures, Dropped int64
 }
 
 // Queue takes the alerts raised, holds back those it must, and sends the
@@ -264,7 +264,7 @@ type destination struct {
 	// waiting are the alerts waiting to be sent, oldest first.
 	waiting []*Alert
 
-	sent, failed, dropped atomic.Int64
+	sent, sendFailures, dropped atomic.Int64
 }
 
 // cooldownKey is what makes an alert a repeat of another: the same event
@@ -426,7 +426,9 @@ func (q *Queue) Counts(name string) Counts {
 	for _, d := range q.destinations {
 		if d.name == name {
 			return Counts{
-				Sent: d.sent.Load(), Failed: d.failed.Load(), Dropped: d.dropped.Load(),
+				Sent:         d.sent.Load(),
+				SendFailures: d.sendFailures.Load(),
+				Dropped:      d.dropped.Load(),
 			}
 		}
 	}
@@ -675,7 +677,7 @@ func (d *destination) run(ctx context.Context) {
 				retryAt = time.Time{}
 			case errors.Is(err, errRefused):
 				d.remove(alert)
-				d.failed.Add(1)
+				d.sendFailures.Add(1)
 				d.dropped.Add(1)
 
 				retryDelay = 0
@@ -684,7 +686,7 @@ func (d *destination) run(ctx context.Context) {
 				d.processLog.Warn("gave up an alert "+d.setting+" refused",
 					"event", alert.Event, "error", err.Error())
 			case ctx.Err() == nil: // not cut off as sww stops
-				d.failed.Add(1)
+				d.sendFailures.Add(1)
 
 				retryDelay = min(max(retryDelayFactor*retryDelay, firstRetryDelay),
 					maxRetryDelay)
@@ -871,7 +873,7 @@ func ntfyPriority(event string) string {
 		return "high"
 	case EventReputationHit:
 		return "low"
-	default: // ban, waf_block and summary
+	default: // ban, core_rule_set_match and summary
 		return "default"
 	}
 }
@@ -882,7 +884,7 @@ func ntfyTag(event string) string {
 	switch event {
 	case EventBan, EventPermanentBan:
 		return "no_entry"
-	case EventWAFBlock:
+	case EventCoreRuleSetMatch:
 		return "shield"
 	case EventAnomaly:
 		return "chart_with_upwards_trend"

internal/alerts/alerts_test.go

@@ -897,7 +897,7 @@ func TestDestinationThatDoesNotAnswerHoldsUpNeitherOther(t *testing.T) {
 		synctest.Wait()
 
 		wantDestinationCounts(t, q, alerts.DestinationSlack,
-			alerts.Counts{Sent: 3, Failed: 1})
+			alerts.Counts{Sent: 3, SendFailures: 1})
 
 		logged := log.String()
 		if !strings.Contains(logged,
@@ -934,7 +934,7 @@ func TestDropsAreCountedForEachDestination(t *testing.T) {
 		for destination, want := range map[string]alerts.Counts{
 			alerts.DestinationWebhook: {Sent: all},
 			alerts.DestinationSlack:   {Dropped: 1},
-			alerts.DestinationNtfy:    {Failed: all, Dropped: all},
+			alerts.DestinationNtfy:    {SendFailures: all, Dropped: all},
 		} {
 			wantDestinationCounts(t, q, destination, want)
 		}
@@ -1223,12 +1223,12 @@ func wantEvents(t *testing.T, webhook *standIn, want ...string) {
 // requests to it that it counts as failed, the alerts it counts as held
 // back, and those it counts as dropped for the webhook.
 func wantCounts(
-	t *testing.T, q *alerts.Queue, sent, failed, suppressed, dropped int64,
+	t *testing.T, q *alerts.Queue, sent, sendFailures, suppressed, dropped int64,
 ) {
 	t.Helper()
 
 	wantDestinationCounts(t, q, alerts.DestinationWebhook,
-		alerts.Counts{Sent: sent, Failed: failed, Dropped: dropped})
+		alerts.Counts{Sent: sent, SendFailures: sendFailures, Dropped: dropped})
 
 	if q.Suppressed() != suppressed {
 		t.Errorf("%d alerts held back, want %d", q.Suppressed(), suppressed)
@@ -1281,12 +1281,12 @@ func anAlertForEachEvent() []eventMessage {
 		},
 		{
 			alerts.Alert{
-				Event: alerts.EventWAFBlock, Client: netip.MustParseAddr("192.0.2.1"),
+				Event: alerts.EventCoreRuleSetMatch, Client: netip.MustParseAddr("192.0.2.1"),
 				Netblock: netip.MustParsePrefix("192.0.2.1/32"),
 				Reason:   "refused by the Core Rule Set",
 				Host:     "app.example",
 			},
-			"fsn1app1/blog: waf_block", "default shield",
+			"fsn1app1/blog: core_rule_set_match", "default shield",
 			"refused by the Core Rule Set\nhost: app.example\nclient: 192.0.2.1\n" +
 				"netblock: 192.0.2.1/32",
 		},

internal/anomaly/anomaly.go

@@ -37,13 +37,13 @@ const (
 	ScopeASN = "asn"
 	// ScopeTotal is the whole service.
 	ScopeTotal = "total"
-	// ScopeWatch is a named netblock of SWW_WATCH_NETS.
+	// ScopeWatchedNet is a named netblock of SWW_WATCH_NETS.
-	ScopeWatch = "watch"
+	ScopeWatchedNet = "watched_net"
 )
 
 // Scopes returns every scope.
 func Scopes() []string {
-	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatch}
+	return []string{ScopeClient, ScopeNet, ScopeASN, ScopeTotal, ScopeWatchedNet}
 }
 
 // The windows a counter counts in, as the alerts name them.
@@ -257,7 +257,7 @@ func (c *Counters) scopesOf(r Request) []scope {
 	for _, named := range p.NamedNetblocks {
 		if named.Netblock.Contains(client) {
 			all = append(all, scope{
-				key{scope: ScopeWatch, netblock: named.Netblock, name: named.Name}, p.Watch,
+				key{scope: ScopeWatchedNet, netblock: named.Netblock, name: named.Name}, p.Watch,
 			})
 		}
 	}
@@ -391,7 +391,7 @@ func alertFor(r Request, k key, o overThreshold) alerts.Alert {
 		detail["asn"] = k.asn
 	case ScopeTotal:
 		counted = "the whole service"
-	default: // watch
+	default: // watched_net
 		counted = "the named netblock " + k.name + ", " + k.netblock.String()
 		detail["name"] = k.name
 	}

internal/bans/admin_test.go

@@ -13,7 +13,7 @@ func TestBanWithoutACauseIsAnAdmins(t *testing.T) {
 	t.Parallel()
 
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{{Netblock: netblock, Start: midnight()}})
 
 	if got := ledger.Bans(netblock)[0].Cause; got != bans.CauseAdmin {
@@ -24,9 +24,9 @@ func TestBanWithoutACauseIsAnAdmins(t *testing.T) {
 func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 	t.Parallel()
 
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 1
+	params.MaxBans = 1
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	adminsOnly := netip.MustParsePrefix("198.51.100.0/24")
 	both := netip.MustParsePrefix("203.0.113.1/32")
 	second := netip.MustParsePrefix("203.0.113.2/32")
@@ -64,9 +64,9 @@ func TestAdminsBansAreNeverDroppedAndDoNotCountTowardMaxBans(t *testing.T) {
 func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
 	t.Parallel()
 
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 2
+	params.MaxBans = 2
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	netblock := netip.MustParsePrefix("203.0.113.1/32")
 	other := netip.MustParsePrefix("203.0.113.2/32")
 
@@ -93,7 +93,7 @@ func TestEarlierBansCountABanDroppedAfterAnAdminsBan(t *testing.T) {
 func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.1/32")
 
 	// The netblock breaks a limit twice, the second time after its first
@@ -117,7 +117,7 @@ func TestEarlierBansCountABanAnAdminKeepsOnce(t *testing.T) {
 func TestReasonOfTheBansSwwMakes(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 
 	limit, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
 		bans.Notes{Kind: "requests", Limit: 1000, Window: "minute"})
@@ -150,7 +150,7 @@ func TestLiftedBanForALimitRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 		Lifted:   midnight().Add(10 * time.Minute),
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{lifted})
 
 	// While it would still last, it refuses nothing, and a limit broken
@@ -181,7 +181,7 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 
 	// A permanent ban for a clear sign of attack, lifted.
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{{
 		Netblock: netblock,
 		Start:    midnight(),
@@ -211,7 +211,7 @@ func TestLiftedBanForAnAttackRefusesNothingAndMakesNoBanLonger(t *testing.T) {
 func TestLoadEditCountsTheBansAnAdminMade(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	made, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.1/32"), midnight(),
 		bans.Notes{})
 	atStart := bans.Ban{
@@ -246,7 +246,7 @@ func TestAdminsBanIsMadeWhileAnotherLasts(t *testing.T) {
 	t.Parallel()
 
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 
 	// An hour's ban for a broken limit.
 	ledger.BanForLimit(netblock, midnight(), bans.Notes{})
@@ -292,7 +292,7 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 	wide := netip.MustParsePrefix("203.0.113.0/24")
 	other := netip.MustParsePrefix("203.0.113.10/32")
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
 		// Ended an hour ago.
 		{
@@ -341,3 +341,48 @@ func TestLiftLiftsEveryActiveBanCoveringTheClient(t *testing.T) {
 
 	wantChanged(t, ledger, false)
 }
+
+func TestPermanentBanOnAWiderNetblockIsReturnedOverATemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	client := netip.MustParseAddr("203.0.113.9")
+	ledger := bans.New(defaultParams())
+
+	// The temporary ban is made first, so that its netblock is looked at first.
+	ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(), bans.Notes{})
+	ledger.BanForAdmin(netip.MustParsePrefix("203.0.113.0/24"), midnight(), time.Time{},
+		"for good")
+
+	wantPermanentBan(t, ledger, client, midnight().Add(time.Minute))
+}
+
+func TestOlderPermanentBanIsReturnedOverANewerTemporaryBan(t *testing.T) {
+	t.Parallel()
+
+	netblock := netip.MustParsePrefix("203.0.113.0/24")
+	ledger := bans.New(defaultParams())
+
+	ledger.BanForAdmin(netblock, midnight(), time.Time{}, "for good")
+	ledger.BanForAdmin(netblock, midnight().Add(time.Minute), midnight().Add(time.Hour),
+		"for an hour")
+
+	wantPermanentBan(t, ledger, netblock.Addr(), midnight().Add(2*time.Minute))
+}
+
+// wantPermanentBan checks that Find and Check return a permanent ban for
+// client at now.
+func wantPermanentBan(
+	t *testing.T, ledger *bans.Ledger, client netip.Addr, now time.Time,
+) {
+	t.Helper()
+
+	for name, look := range map[string]func(netip.Addr, time.Time) (bans.Ban, bool, bool){
+		"Find":  ledger.Find,
+		"Check": ledger.Check,
+	} {
+		ban, banned, _ := look(client, now)
+		if !banned || !ban.Permanent() {
+			t.Errorf("%s returned %+v and banned %v, want a permanent ban", name, ban, banned)
+		}
+	}
+}

internal/bans/bans.go

@@ -40,8 +40,8 @@ const repeatFactor = 3
 // maxTextBytes is how much of each text in a ban's notes is kept.
 const maxTextBytes = 256
 
-// Rules are how long a ban lasts, and how many bans are held.
+// Params are how long a ban lasts, and how many bans are held.
-type Rules struct {
+type Params struct {
 	// LimitBanDuration is how long a first ban for a broken limit lasts.
 	LimitBanDuration time.Duration
 	// LimitBanRepeatWindow is how soon after the end of the netblock's
@@ -180,7 +180,7 @@ type Request struct {
 
 // Ledger holds the bans. It is safe for concurrent use.
 type Ledger struct {
-	rules Rules
+	params Params
 	// changed receives a value when a ban is made, unless one is waiting
 	// already.
 	changed chan struct{}
@@ -190,7 +190,7 @@ type Ledger struct {
 	// Find make each netblock they find the most recently seen.
 	netblocks *simplelru.LRU[netip.Prefix, *[]Ban]
 	// held is how many bans netblocks holds whose cause is not CauseAdmin,
-	// at most rules.MaxBans.
+	// at most params.MaxBans.
 	held int
 	// made is how many bans have been made since the start, by cause: by
 	// the ledger, and by an admin, through BanForAdmin or in an edit of
@@ -205,7 +205,7 @@ type Ledger struct {
 }
 
 // New returns a Ledger with no ban yet.
-func New(rules Rules) *Ledger {
+func New(params Params) *Ledger {
 	// The ledger drops bans itself, and never those whose cause is
 	// CauseAdmin, however many there are, so the LRU has no limit of its
 	// own: it keeps the netblocks in the order they were last seen.
@@ -215,7 +215,7 @@ func New(rules Rules) *Ledger {
 	}
 
 	return &Ledger{
-		rules:     rules,
+		params:    params,
 		changed:   make(chan struct{}, 1),
 		netblocks: netblocks,
 		made:      map[string]int{},
@@ -274,16 +274,27 @@ func (l *Ledger) Find(client netip.Addr, now time.Time) (Ban, bool, bool) {
 
 // activeBan returns the ban in bans, a netblock's bans oldest first, that
 // is active at now, or nil when none is. If several are, it returns the
-// one that started last. Every ban is looked at, since a ban an admin adds
+// newest permanent one, or the newest when none is permanent. Every ban is
-// to bans.json can start before the netblock's others and outlast them.
+// looked at, since a ban an admin adds to bans.json can start before the
+// netblock's others and outlast them.
 func activeBan(bans []Ban, now time.Time) *Ban {
+	var newest *Ban
+
 	for i := len(bans) - 1; i >= 0; i-- {
-		if bans[i].ActiveAt(now) {
+		if !bans[i].ActiveAt(now) {
+			continue
+		}
+
+		if bans[i].Permanent() {
 			return &bans[i]
 		}
+
+		if newest == nil {
+			newest = &bans[i]
+		}
 	}
 
-	return nil
+	return newest
 }
 
 // BanForLimit bans netblock at now for a broken limit, with notes, and
@@ -743,13 +754,16 @@ func (l *Ledger) markChanged() {
 }
 
 // active returns the ban active at now on a netblock client is in, or
-// nil.
+// nil. If several netblocks have one, it returns a permanent ban when
+// there is one.
 func (l *Ledger) active(client netip.Addr, now time.Time) *Ban {
 	lengths := l.v6Lengths
 	if client.Is4() {
 		lengths = l.v4Lengths
 	}
 
+	var first *Ban
+
 	for _, length := range lengths {
 		bans, found := l.netblocks.Get(netip.PrefixFrom(client, length).Masked())
 		if !found {
@@ -757,12 +771,20 @@ func (l *Ledger) active(client netip.Addr, now time.Time) *Ban {
 		}
 
 		ban := activeBan(*bans, now)
-		if ban != nil {
+		if ban == nil {
+			continue
+		}
+
+		if ban.Permanent() {
 			return ban
 		}
+
+		if first == nil {
+			first = ban
+		}
 	}
 
-	return nil
+	return first
 }
 
 // covering returns the bans of each netblock held that client is in,
@@ -790,7 +812,7 @@ func (l *Ledger) covering(client netip.Addr) []*[]Ban {
 // unless ban's cause is CauseAdmin, which does not count toward MaxBans.
 func (l *Ledger) add(ban Ban) {
 	counted := ban.Cause != CauseAdmin
-	if counted && l.held == l.rules.MaxBans {
+	if counted && l.held == l.params.MaxBans {
 		l.dropOne()
 	}
 
@@ -825,7 +847,7 @@ func (l *Ledger) add(ban Ban) {
 // new ban longer. A ban an admin adds to bans.json can start after
 // another and end before it, so that one is looked for among them all.
 func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
-	length := l.rules.LimitBanDuration
+	length := l.params.LimitBanDuration
 
 	var last *Ban
 
@@ -836,18 +858,18 @@ func (l *Ledger) limitExpiry(held []Ban, now time.Time) time.Time {
 		}
 	}
 
-	if last != nil && now.Sub(last.Expires) <= l.rules.LimitBanRepeatWindow {
+	if last != nil && now.Sub(last.Expires) <= l.params.LimitBanRepeatWindow {
 		lastLength := last.Expires.Sub(last.Start)
 		// This is repeatFactor * lastLength > MaxBanDuration, written so
 		// that it cannot overflow.
-		if lastLength > l.rules.MaxBanDuration/repeatFactor {
+		if lastLength > l.params.MaxBanDuration/repeatFactor {
 			return time.Time{}
 		}
 
 		length = repeatFactor * lastLength
 	}
 
-	if length > l.rules.MaxBanDuration {
+	if length > l.params.MaxBanDuration {
 		return time.Time{}
 	}
 
@@ -865,7 +887,7 @@ func (l *Ledger) attackExpiry(held []Ban, now time.Time) time.Time {
 		}
 	}
 
-	return now.Add(l.rules.AttackBanDuration)
+	return now.Add(l.params.AttackBanDuration)
 }
 
 // dropOne drops the earliest ban whose cause is not CauseAdmin of the

internal/bans/bans_test.go

@@ -15,7 +15,7 @@ const day = 24 * time.Hour
 func TestRepeatsTripleUntilPermanent(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
 
@@ -62,7 +62,7 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			ledger := bans.New(defaultRules())
+			ledger := bans.New(defaultParams())
 			netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 			first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
@@ -80,9 +80,9 @@ func TestRepeatWindowRunsOut(t *testing.T) {
 func TestFirstBanLongerThanTheMaximumIsPermanent(t *testing.T) {
 	t.Parallel()
 
-	rules := defaultRules()
+	params := defaultParams()
-	rules.LimitBanDuration = rules.MaxBanDuration + time.Hour
+	params.LimitBanDuration = params.MaxBanDuration + time.Hour
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 
 	ban, _ := ledger.BanForLimit(netip.MustParsePrefix("203.0.113.9/32"), midnight(),
 		bans.Notes{})
@@ -97,9 +97,9 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 	// With bans of up to 100,000 days, the 14th ban in a row, of 3^13
 	// hours, is within the maximum, and three times as long would not fit
 	// in a time.Duration. The 15th is permanent.
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBanDuration = 100000 * day
+	params.MaxBanDuration = 100000 * day
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
 
@@ -121,7 +121,7 @@ func TestLongestBanSetFarOffDoesNotOverflow(t *testing.T) {
 func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	first, made := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
@@ -146,7 +146,7 @@ func TestBrokenLimitDuringABanMakesNoOther(t *testing.T) {
 func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
 
@@ -178,7 +178,7 @@ func TestCheckRefusesWhileTheBanLastsAndCountsTheRefusals(t *testing.T) {
 func TestFindCountsNothing(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	ban, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{Requests: 5})
 
@@ -200,9 +200,9 @@ func TestFindCountsNothing(t *testing.T) {
 func TestMaxBansDropsTheEarliestBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 	t.Parallel()
 
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 3
+	params.MaxBans = 3
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	a := netip.MustParsePrefix("203.0.113.1/32")
 	b := netip.MustParsePrefix("203.0.113.2/32")
 	c := netip.MustParsePrefix("203.0.113.3/32")
@@ -239,9 +239,9 @@ func TestFullLedgerDropsTheEarlierBanOfTheNetblockBannedAgain(t *testing.T) {
 
 	// With room for one ban, the netblock's ended ban goes to make room for
 	// its new one, whose notes still count it.
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 1
+	params.MaxBans = 1
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
@@ -258,7 +258,7 @@ func TestFullLedgerDropsTheEarlierBanOfTheNetblockBannedAgain(t *testing.T) {
 func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	notes := bans.Notes{RuleID: "env-file", Target: "path"}
 
@@ -304,7 +304,7 @@ func TestRequestDuringAnAttackBanMakesItPermanent(t *testing.T) {
 func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	// A ban for a broken limit before does not count.
@@ -336,7 +336,7 @@ func TestAttackAfterAnAttackBanHasEndedBansPermanently(t *testing.T) {
 func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	first, _ := ledger.BanForLimit(netblock, midnight(), bans.Notes{})
 	wantChanged(t, ledger, true)
@@ -380,7 +380,7 @@ func TestWouldBanGivesTheBanWithoutMakingIt(t *testing.T) {
 func TestWouldBePermanentAnswersAsTheBanWouldBeMade(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	now := midnight()
 
@@ -414,7 +414,7 @@ func TestWouldBePermanentAnswersAsTheBanWouldBeMade(t *testing.T) {
 func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	// Three times the seven days would be permanent; a limit broken as the
@@ -436,7 +436,7 @@ func TestAttackBanDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	long := strings.Repeat("a", 300)
 	request := bans.Request{
@@ -458,7 +458,7 @@ func TestRequestTextsAreCutTo256Bytes(t *testing.T) {
 func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	other := netip.MustParsePrefix("198.51.100.7/32")
 
@@ -494,9 +494,9 @@ func TestLookupFillsTheNotesOfTheNetblocksBansWithoutOne(t *testing.T) {
 	}
 }
 
-// defaultRules are the rules at the settings' defaults.
+// defaultParams are the params at the settings' defaults.
-func defaultRules() bans.Rules {
+func defaultParams() bans.Params {
-	return bans.Rules{
+	return bans.Params{
 		LimitBanDuration:     time.Hour,
 		LimitBanRepeatWindow: day,
 		MaxBanDuration:       7 * day,

internal/bans/crowdsec_test.go

@@ -15,7 +15,7 @@ const scenario = "crowdsecurity/ssh-bf"
 func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
 
@@ -49,7 +49,7 @@ func TestCrowdSecBanLastsUntilTheDecisionEnds(t *testing.T) {
 func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	expires := midnight().Add(4 * time.Hour)
 	ledger.BanForCrowdSec(netblock, midnight(), expires, scenario, bans.Notes{})
@@ -72,7 +72,7 @@ func TestCrowdSecBanIsNeverMadePermanent(t *testing.T) {
 func TestCrowdSecBanIsCountedAndDoesNotLengthenTheNextBanForALimit(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	// Three times the three days would be permanent; a limit broken as the

internal/bans/snapshot_test.go

@@ -14,7 +14,7 @@ import (
 func TestChangedAfterABanIsMade(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 
 	wantChanged(t, ledger, false)
@@ -38,7 +38,7 @@ func TestChangedAfterABanIsMade(t *testing.T) {
 func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 	t.Parallel()
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	v6 := netip.MustParsePrefix("2001:db8::/64")
 	high := netip.MustParsePrefix("203.0.113.10/32")
 	low := netip.MustParsePrefix("203.0.113.9/32")
@@ -67,14 +67,14 @@ func TestSnapshotListsEveryBanByNetblock(t *testing.T) {
 func TestLoadedBansCarryOn(t *testing.T) {
 	t.Parallel()
 
-	before := bans.New(defaultRules())
+	before := bans.New(defaultParams())
 	netblock := netip.MustParsePrefix("203.0.113.9/32")
 	ban, _ := before.BanForLimit(netblock, midnight(), bans.Notes{Limit: 1})
 
 	// Loaded into a new ledger, as across a restart, the ban still refuses
 	// while it lasts, and once it has ended a broken limit bans for three
 	// times as long, with the loaded ban counted among the earlier ones.
-	after := bans.New(defaultRules())
+	after := bans.New(defaultParams())
 	after.Load(before.Snapshot())
 
 	_, banned, _ := after.Check(netblock.Addr(), ban.Expires.Add(-time.Second))
@@ -96,7 +96,7 @@ func TestLoadedBanRefusesEveryClientInItsNetblock(t *testing.T) {
 	// Two entries as an admin might write them, with addresses not masked
 	// to their lengths, the IPv6 one shorter than the /64 an IPv6 client's
 	// ban covers, beside a ban the ledger makes on one IPv4 address.
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{
 		{Netblock: netip.MustParsePrefix("203.0.113.9/24"), Start: midnight()},
 		{Netblock: netip.MustParsePrefix("2001:db8::1/48"), Start: midnight()},
@@ -145,7 +145,7 @@ func TestPermanentBanStartedBeforeAnEndedOneRefuses(t *testing.T) {
 		Expires:  midnight().Add(time.Hour),
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{permanent, ended})
 
 	now := midnight().Add(2 * time.Hour)
@@ -189,7 +189,7 @@ func TestNextBanWorkedOutFromTheBanThatEndedLast(t *testing.T) {
 		Expires:  midnight().Add(2 * time.Hour),
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{nineHours, admins})
 
 	// Once both have ended, a limit broken within the repeat window bans
@@ -219,9 +219,9 @@ func TestLoadKeepsAtMostMaxBansDroppingTheEarliest(t *testing.T) {
 		Cause:    bans.CauseLimit,
 	}
 
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 1
+	params.MaxBans = 1
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	ledger.Load([]bans.Ban{later, earlier})
 
 	held := ledger.Snapshot()
@@ -235,9 +235,9 @@ func TestLoadReplacesTheBansHeld(t *testing.T) {
 
 	// Room for three bans, so that the second load, were it added to the
 	// two bans held, would drop none of them to make room.
-	rules := defaultRules()
+	params := defaultParams()
-	rules.MaxBans = 3
+	params.MaxBans = 3
-	ledger := bans.New(rules)
+	ledger := bans.New(params)
 	kept := bans.Ban{
 		Netblock: netip.MustParsePrefix("2001:db8::/64"),
 		Start:    midnight(),
@@ -285,7 +285,7 @@ func TestLoadCutsTheTextsTo256Bytes(t *testing.T) {
 		}},
 	}
 
-	ledger := bans.New(defaultRules())
+	ledger := bans.New(defaultParams())
 	ledger.Load([]bans.Ban{ban})
 
 	cut := long[:256]

internal/config/config.go

@@ -12,6 +12,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"maps"
 	"math"
 	"net"
 	"net/http"
@@ -106,6 +107,9 @@ type Config struct {
 	TagLists        []TagList
 	TagDeny         []string
 	TagLimitPercent map[string]int64
+	// RouteWatchURL is where the routewatch instance is that adds the asn=
+	// and prefix= tags, "" for none (SWW_ROUTEWATCH_URL).
+	RouteWatchURL string
 	// The biased thresholds. ASNBytesPercent and CountryBytesPercent give
 	// those they list a percentage of the byte limits in place of the one
 	// TagLimitPercent gives their asn= or country= tag
@@ -332,7 +336,7 @@ const (
 	maxParanoiaLevel = 4
 	// firstSetupRuleID to lastSetupRuleID are the ids the Core Rule Set
 	// keeps for the rules that set it up, which sww's own rules
-	// have too (see internal/waf). Switching one off would undo a change
+	// have too (see internal/coreruleset). Switching one off would undo a change
 	// that no setting undoes.
 	firstSetupRuleID = 900000
 	lastSetupRuleID  = 900999
@@ -428,7 +432,7 @@ var (
 		"holds a control character, such as the carriage return of a Windows line end",
 	)
 	errNotAlertEvent = errors.New(
-		"is not ban, permanent_ban, waf_block, anomaly, reputation_hit, " +
+		"is not ban, permanent_ban, core_rule_set_match, anomaly, reputation_hit, " +
 			"source_failure or file_error")
 	errNotNumberOrOff = errors.New(
 		"is not a whole number above zero, such as 60, or off",
@@ -462,6 +466,9 @@ var (
 	errNotLAPIURL = errors.New(
 		"is not an http or https URL without a user or a fragment, " +
 			"such as http://172.17.0.1:8080")
+	errNotRouteWatchURL = errors.New(
+		"is not an http or https URL without a user or a fragment, " +
+			"such as https://routewatch.example")
 	errNeedsLAPIKey  = errors.New("the engine answers no request without it")
 	errLAPIKeyUnused = errors.New("it is sent only to the engine at that URL")
 	errAnotherList   = errors.New(
@@ -475,6 +482,8 @@ var (
 		"is not a tag, : and a percentage, such as vpn:50 or asn=14061:25")
 	errNotTagPercent = errors.New("is not a percentage from 1 to 99")
 	errNotASNTag     = errors.New("is not asn= and a number, such as asn=14061")
+	errNotPrefixTag  = errors.New(
+		"is not prefix= and a netblock, such as prefix=192.0.2.0/24")
 	errExploitTag = errors.New(
 		"cannot lower limits: the rate limits count a request before its " +
 			"rules are matched")
@@ -483,8 +492,9 @@ var (
 	errNoRequestGetsTag = errors.New(
 		"is a tag no request can get: it is not a name in SWW_TAG_LISTS, an " +
 			"asn= or country= tag, a dnsbl= tag of a zone in SWW_DNSBL_ZONES, " +
-			"abuseipdb with SWW_ABUSEIPDB_KEY set, or exploitsignature with " +
+			"a prefix= tag with SWW_ROUTEWATCH_URL set, abuseipdb with " +
-			"rule files or the Core Rule Set on")
+			"SWW_ABUSEIPDB_KEY set, or exploitsignature with rule files or the " +
+			"Core Rule Set on")
 )
 
 // FromEnvironment reads the settings with lookupEnv, normally
@@ -524,6 +534,7 @@ func FromEnvironment(
 		TagLists:             env.tagLists("SWW_TAG_LISTS"),
 		TagDeny:              env.tags("SWW_TAG_DENY"),
 		TagLimitPercent:      env.tagPercents("SWW_TAG_LIMIT_PERCENT"),
+		RouteWatchURL:        env.routeWatchURL("SWW_ROUTEWATCH_URL"),
 		ASNBytesPercent:      env.percents("SWW_ASN_BYTES_PERCENT", ParseASN),
 		CountryBytesPercent:  env.percents("SWW_COUNTRY_BYTES_PERCENT", parseCountry),
 		UnknownLimitPercent:  env.percent("SWW_UNKNOWN_LIMIT_PERCENT", "100"),
@@ -1019,6 +1030,22 @@ func (e *environment) crowdSecDecisionsURL(name string) string {
 	return lapi.JoinPath("v1", "decisions").String()
 }
 
+// routeWatchURL reads the setting that is the URL of a routewatch instance,
+// "" while it is unset or empty.
+func (e *environment) routeWatchURL(name string) string {
+	value := e.value(name, "")
+	if value == "" {
+		return ""
+	}
+
+	instance, err := url.Parse(value)
+	if err != nil || !isHTTPURL(instance) {
+		e.check(name, fmt.Errorf("%q %w", value, errNotRouteWatchURL))
+	}
+
+	return value
+}
+
 // lookupSource reads the setting that is where clients are looked up:
 // geojs, file, or off.
 func (e *environment) lookupSource(name, defaultValue string) string {
@@ -1064,14 +1091,21 @@ func (e *environment) checkCountriesAndLookups(cfg *Config) {
 		return
 	}
 
+	// routewatch gives asn= tags too.
+	onlyLookupGives := func(tag string) bool {
+		return isLookupTag(tag) &&
+			(cfg.RouteWatchURL == "" || !strings.HasPrefix(tag, ASNTagPrefix))
+	}
+
 	for _, setting := range []struct {
 		name string
 		set  bool
 	}{
 		{"SWW_EXCLUSIVELY_ALLOWED_COUNTRIES", len(cfg.ExclusivelyAllowedCountries) > 0},
 		{"SWW_ADD_LOOKUP_HEADERS", cfg.AddLookupHeaders},
-		{"SWW_TAG_DENY", slices.ContainsFunc(cfg.TagDeny, isLookupTag)},
+		{"SWW_TAG_DENY", slices.ContainsFunc(cfg.TagDeny, onlyLookupGives)},
-		{"SWW_TAG_LIMIT_PERCENT", tagLimitNeedsLookups(cfg)},
+		{"SWW_TAG_LIMIT_PERCENT", slices.ContainsFunc(
+			slices.Collect(maps.Keys(cfg.TagLimitPercent)), onlyLookupGives)},
 		{"SWW_ASN_BYTES_PERCENT", len(cfg.ASNBytesPercent) > 0},
 		{"SWW_COUNTRY_BYTES_PERCENT", len(cfg.CountryBytesPercent) > 0},
 		{"SWW_UNKNOWN_LIMIT_PERCENT", cfg.UnknownLimitPercent < 100},
@@ -1171,6 +1205,10 @@ func requestCanGetTag(cfg *Config, tag string) bool {
 		return cfg.AbuseIPDBKey != ""
 	}
 
+	if strings.HasPrefix(tag, PrefixTagPrefix) {
+		return cfg.RouteWatchURL != ""
+	}
+
 	zone, isZoneTag := strings.CutPrefix(tag, DNSBLTagPrefix)
 
 	return isZoneTag && slices.ContainsFunc(cfg.DNSBLZones, func(each string) bool {
@@ -1179,7 +1217,7 @@ func requestCanGetTag(cfg *Config, tag string) bool {
 }
 
 // TagsNeedLookup reports whether SWW_TAG_DENY or SWW_TAG_LIMIT_PERCENT
-// names an asn= or country= tag, which only the lookup can give a request.
+// names an asn= or country= tag.
 func (c *Config) TagsNeedLookup() bool {
 	return slices.ContainsFunc(c.TagDeny, isLookupTag) || tagLimitNeedsLookups(c)
 }
@@ -1923,6 +1961,7 @@ const (
 	ASNTagPrefix     = "asn="
 	CountryTagPrefix = "country="
 	DNSBLTagPrefix   = "dnsbl="
+	PrefixTagPrefix  = "prefix="
 	AbuseIPDBTag     = "abuseipdb"
 	CrowdSecTag      = "crowdsec"
 	// ExploitSignatureTag is the tag of a request a rule file or the Core
@@ -1999,9 +2038,10 @@ func parseTags(value string) ([]string, error) {
 
 // parseTag reads a tag in either case, with spaces around it, and returns it
 // as a request carries it: in lower case, but for a country code, which is in
-// capitals, and an asn= tag's number without leading zeros. An asn= or
+// capitals, an asn= tag's number without leading zeros, and a prefix= tag's
-// country= tag must name a number or a country, so that a mistyped one stops
+// netblock as routewatch writes it. An asn=, country= or prefix= tag must name
-// the start instead of never matching.
+// a number, a country or a netblock, so that a mistyped one stops the start
+// instead of never matching.
 func parseTag(value string) (string, error) {
 	tag := strings.ToLower(strings.TrimSpace(value))
 
@@ -2023,6 +2063,15 @@ func parseTag(value string) (string, error) {
 		return CountryTagPrefix + country, nil
 	}
 
+	if text, isPrefix := strings.CutPrefix(tag, PrefixTagPrefix); isPrefix {
+		netblock, err := netip.ParsePrefix(text)
+		if err != nil || netblock != netblock.Masked() {
+			return "", fmt.Errorf("%q %w", value, errNotPrefixTag)
+		}
+
+		return PrefixTagPrefix + netblock.String(), nil
+	}
+
 	return tag, nil
 }
 

internal/config/config_test.go

@@ -61,6 +61,7 @@ const (
 	reputationAction     = "SWW_REPUTATION_ACTION"
 	reputationCacheTTL   = "SWW_REPUTATION_CACHE_TTL"
 	reputationTimeout    = "SWW_REPUTATION_TIMEOUT"
+	routeWatchURL        = "SWW_ROUTEWATCH_URL"
 	crowdSecURL          = "SWW_CROWDSEC_LAPI_URL"
 	crowdSecKey          = "SWW_CROWDSEC_LAPI_KEY"
 	banResponse          = "SWW_BAN_RESPONSE"
@@ -159,7 +160,7 @@ func loggedAnomalyDefaults() map[string]string {
 // defaultAlertEvents is the default of SWW_ALERT_EVENTS, and
 // defaultAlertCooldown that of SWW_ALERT_COOLDOWN.
 const (
-	defaultAlertEvents = "ban,permanent_ban,waf_block,anomaly,reputation_hit," +
+	defaultAlertEvents = "ban,permanent_ban,core_rule_set_match,anomaly,reputation_hit," +
 		"source_failure,file_error"
 	defaultAlertCooldown = "15m"
 )
@@ -1403,6 +1404,63 @@ func TestTagSettingsAsSet(t *testing.T) {
 	}
 }
 
+func TestRouteWatchURLAndPrefixTags(t *testing.T) {
+	t.Parallel()
+
+	const rw = "https://routewatch.example"
+
+	if cfg := fromEnvironment(t, environment{}); cfg.RouteWatchURL != "" {
+		t.Errorf("default %s is %q, want unset", routeWatchURL, cfg.RouteWatchURL)
+	}
+
+	cfg := fromEnvironment(t, environment{
+		routeWatchURL: rw, tagDeny: "prefix=2001:DB8::/32",
+		tagLimitPercent: "prefix=192.0.2.0/24:50",
+	})
+	wantDeny := []string{"prefix=2001:db8::/32"}
+
+	if cfg.RouteWatchURL != rw || !slices.Equal(cfg.TagDeny, wantDeny) ||
+		cfg.TagLimitPercent["prefix=192.0.2.0/24"] != 50 {
+		t.Errorf("gave %q, %v, %v", cfg.RouteWatchURL, cfg.TagDeny, cfg.TagLimitPercent)
+	}
+
+	// routewatch gives asn= tags too, so an asn= tag needs no lookups while it is set.
+	fromEnvironment(t, environment{
+		lookupSource: off, routeWatchURL: rw, tagDeny: "asn=64496",
+	})
+
+	for _, stopped := range []struct {
+		env  environment
+		name string
+	}{
+		{environment{routeWatchURL: "ftp://routewatch.example"}, routeWatchURL},
+		{environment{routeWatchURL: "routewatch.example"}, routeWatchURL},
+		{environment{tagDeny: "prefix=192.0.2.0/24"}, tagDeny},
+		{environment{routeWatchURL: rw, tagDeny: "prefix=nowhere"}, tagDeny},
+		{environment{routeWatchURL: rw, tagDeny: "prefix=192.0.2.5/24"}, tagDeny},
+		{
+			environment{routeWatchURL: rw, tagLimitPercent: "prefix=192.0.2.0/33:50"},
+			tagLimitPercent,
+		},
+		{environment{lookupSource: off, routeWatchURL: rw, tagDeny: "country=DE"}, tagDeny},
+		{environment{lookupSource: off, tagDeny: "asn=64496"}, tagDeny},
+	} {
+		_, err := config.FromEnvironment(stopped.env.lookupEnv)
+		if err == nil || !strings.HasPrefix(err.Error(), stopped.name+": ") {
+			t.Errorf("%v gave the error %v, want one naming %s", stopped.env, err, stopped.name)
+		}
+	}
+
+	badURL := environment{routeWatchURL: "ftp://routewatch.example"}
+	_, err := config.FromEnvironment(badURL.lookupEnv)
+
+	want := routeWatchURL + `: "ftp://routewatch.example" is not an http or https URL ` +
+		"without a user or a fragment, such as https://routewatch.example"
+	if err == nil || err.Error() != want {
+		t.Errorf("error %v, want %s", err, want)
+	}
+}
+
 func TestTagThatNoRequestCanGetIsToldApartFromOneItCan(t *testing.T) {
 	t.Parallel()
 
@@ -2503,6 +2561,7 @@ func TestLogsEachSettingWithItsValue(t *testing.T) {
 		reputationAction:     "limit:25",
 		reputationCacheTTL:   defaultReputationCacheTTL,
 		reputationTimeout:    "2s",
+		routeWatchURL:        "",
 		crowdSecURL:          "",
 		crowdSecKey:          "",
 		banResponse:          "403",

internal/coreruleset/coreruleset.go

@@ -1,6 +1,6 @@
-// Package waf runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
+// Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
 // method, the URL with its query and the headers of a request, and on its
-// body while SWW_WAF_BODY_LIMIT is set, with the eight changes sww
+// body while SWW_WAF_BODY_LIMIT is set, with the nine changes sww
 // makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
 // "Attack detection" under "Settings" in SPEC.md describes them. It reads no
 // response.
@@ -9,7 +9,7 @@
 // its no_fs_access tag, as the Dockerfile and script/build build it: of a
 // file in a multipart body, Coraza then counts the bytes instead of
 // writing them to the system's temporary directory.
-package waf
+package coreruleset
 
 import (
 	_ "embed"
@@ -32,8 +32,8 @@ import (
 
 // directives are the Core Rule Set as sww runs it, with the
 // paranoia level for %d, bodyDirectives for the first %s while
-// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second, and
+// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
-// giteaExclusions for the third.
+// giteaExclusions for the third, and wordpressExclusions for the fourth.
 // Each rule sww adds has an id from 900000 to 900999, the ids the
 // Core Rule Set keeps for the rules that set it up, which
 // SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
@@ -84,6 +84,9 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
 # The eighth change comes before the rules for the same reason.
 %s
 
+# The ninth change comes before the rules for the same reason.
+%s
+
 # The sixth: only the rules for requests are loaded, and no response is
 # inspected.
 Include @owasp_crs/REQUEST-*.conf
@@ -175,6 +178,13 @@ SecRule MULTIPART_STRICT_ERROR "!@eq 0" "id:900450,phase:2,pass,\
 //go:embed gitea.conf
 var giteaExclusions string
 
+// wordpressExclusions are the ninth change: the fields of WordPress's own
+// requests that skip the rules that refused them there, as Coraza
+// directives.
+//
+//go:embed wordpress.conf
+var wordpressExclusions string
+
 // cookiesNotRead are the cookies the Core Rule Set reads a request
 // without, the rest of the fifth change.
 //
@@ -284,11 +294,11 @@ func checkExclusions(exclusions string) error {
 // CoreRuleSet is the Core Rule Set, ready to inspect requests. It is safe
 // for concurrent use.
 type CoreRuleSet struct {
-	waf       coraza.WAF
+	engine    coraza.WAF
 	bodyLimit int64
 }
 
-// New returns the Core Rule Set with the eight changes, at params'
+// New returns the Core Rule Set with the nine changes, at params'
 // paranoia level, without the rules it switches off, reading request
 // bodies up to params' limit, and with params' exclusions file loaded
 // before the Core Rule Set's rules. An exclusions file is an error if it
@@ -316,7 +326,7 @@ func New(params Params) (*CoreRuleSet, error) {
 	}
 
 	text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
-		giteaExclusions)
+		giteaExclusions, wordpressExclusions)
 
 	if len(params.DisabledRules) > 0 {
 		ids := make([]string, len(params.DisabledRules))
@@ -327,14 +337,14 @@ func New(params Params) (*CoreRuleSet, error) {
 		text += "SecRuleRemoveById " + strings.Join(ids, " ") + "\n"
 	}
 
-	waf, err := coraza.NewWAF(coraza.NewWAFConfig().
+	engine, err := coraza.NewWAF(coraza.NewWAFConfig().
 		WithRootFS(coreruleset.FS).
 		WithDirectives(text))
 	if err != nil {
 		return nil, fmt.Errorf("load the Core Rule Set: %w", err)
 	}
 
-	return &CoreRuleSet{waf: waf, bodyLimit: params.BodyLimit}, nil
+	return &CoreRuleSet{engine: engine, bodyLimit: params.BodyLimit}, nil
 }
 
 // Result is what the Core Rule Set found in a request.
@@ -354,7 +364,7 @@ type Result struct {
 func (c *CoreRuleSet) Inspect(
 	r *http.Request, client netip.Addr, body io.Reader,
 ) (Result, []byte, error) {
-	tx := c.waf.NewTransaction()
+	tx := c.engine.NewTransaction()
 	// Closing would remove the files Coraza wrote, and it writes none.
 	defer func() { _ = tx.Close() }()
 

internal/coreruleset/coreruleset_test.go

@@ -1,6 +1,7 @@
-package waf_test
+package coreruleset_test
 
 import (
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
@@ -12,7 +13,7 @@ import (
 	"strings"
 	"testing"
 
-	"sneak.berlin/go/smallwebwaf/internal/waf"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 )
 
 // defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
@@ -23,10 +24,12 @@ var defaultDisabledRules = []int{920340, 920420, 920440, 920640, 930130, 930140}
 
 // newCoreRuleSet returns the Core Rule Set at paranoia level level, with
 // the rules in disabled switched off.
-func newCoreRuleSet(t *testing.T, level int, disabled ...int) *waf.CoreRuleSet {
+func newCoreRuleSet(t *testing.T, level int, disabled ...int) *coreruleset.CoreRuleSet {
 	t.Helper()
 
-	crs, err := waf.New(waf.Params{ParanoiaLevel: level, DisabledRules: disabled})
+	crs, err := coreruleset.New(coreruleset.Params{
+		ParanoiaLevel: level, DisabledRules: disabled,
+	})
 	if err != nil {
 		t.Fatalf("load the Core Rule Set: %v", err)
 	}
@@ -49,7 +52,7 @@ func get(target string, headers ...string) request {
 
 // inspect returns what crs finds in r, sent to git.example by a browser,
 // whose Host, User-Agent and Accept r.headers may replace.
-func inspect(t *testing.T, crs *waf.CoreRuleSet, r request) waf.Result {
+func inspect(t *testing.T, crs *coreruleset.CoreRuleSet, r request) coreruleset.Result {
 	t.Helper()
 
 	result, _ := inspectBody(t, crs, r, "")
@@ -60,8 +63,8 @@ func inspect(t *testing.T, crs *waf.CoreRuleSet, r request) waf.Result {
 // inspectBody is inspect for r with body, which is announced with its
 // Content-Length unless it is "", and returns what crs read of body too.
 func inspectBody(
-	t *testing.T, crs *waf.CoreRuleSet, r request, body string,
+	t *testing.T, crs *coreruleset.CoreRuleSet, r request, body string,
-) (waf.Result, string) {
+) (coreruleset.Result, string) {
 	t.Helper()
 
 	req := httptest.NewRequestWithContext(t.Context(), r.method,
@@ -96,7 +99,9 @@ func inspectBody(
 }
 
 // wantResult checks what crs finds in r.
-func wantResult(t *testing.T, crs *waf.CoreRuleSet, r request, want waf.Result) {
+func wantResult(
+	t *testing.T, crs *coreruleset.CoreRuleSet, r request, want coreruleset.Result,
+) {
 	t.Helper()
 
 	if got := inspect(t, crs, r); !reflect.DeepEqual(got, want) {
@@ -106,28 +111,29 @@ func wantResult(t *testing.T, crs *waf.CoreRuleSet, r request, want waf.Result)
 
 // matched is the result of a request that the rules ids match, each of
 // them a critical one, which adds 5 to the score.
-func matched(ids ...int) waf.Result {
+func matched(ids ...int) coreruleset.Result {
 	const critical = 5
 
-	return waf.Result{RuleIDs: ids, Score: critical * len(ids)}
+	return coreruleset.Result{RuleIDs: ids, Score: critical * len(ids)}
 }
 
 // atDefaults returns the Core Rule Set as sww runs it by default.
-func atDefaults(t *testing.T) *waf.CoreRuleSet {
+func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
 	return newCoreRuleSet(t, 1, defaultDisabledRules...)
 }
 
-// wantChange checks that crs lets through passes, a gitea request one of
+// wantChange checks that crs lets through passes, a request one of the
-// the eight changes is for, and still finds result in refused, a request
+// nine changes is for, and still finds result in refused, a request like
-// like it that the change is not for.
+// it that the change is not for.
 func wantChange(
-	t *testing.T, crs *waf.CoreRuleSet, passes, refused request, result waf.Result,
+	t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
+	result coreruleset.Result,
 ) {
 	t.Helper()
 
-	wantResult(t, crs, passes, waf.Result{})
+	wantResult(t, crs, passes, coreruleset.Result{})
 	wantResult(t, crs, refused, result)
 }
 
@@ -162,12 +168,12 @@ func TestExpectAndContentEncodingAreAllowed(t *testing.T) {
 
 	wantResult(t, crs,
 		request{http.MethodPost, push, []string{pushType, length, "Expect: 100-continue"}},
-		waf.Result{})
+		coreruleset.Result{})
 	wantResult(t, crs,
 		request{http.MethodPost, fetch, []string{
 			fetchType, length, "Content-Encoding: gzip",
 		}},
-		waf.Result{})
+		coreruleset.Result{})
 
 	// Every other header on the Core Rule Set's list stays refused.
 	for _, header := range []string{
@@ -196,7 +202,7 @@ func TestTransferEncodingIsRead(t *testing.T) {
 			"Content-Type: application/x-git-receive-pack-request",
 			"Transfer-Encoding: chunked",
 		}},
-		waf.Result{})
+		coreruleset.Result{})
 }
 
 func TestMoreParametersThanCorazaKeepsIsAMatch(t *testing.T) {
@@ -250,7 +256,7 @@ func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testi
 	for _, value := range []struct {
 		name string
 		// result is what a parameter that is not one of gitea's gets.
-		result waf.Result
+		result coreruleset.Result
 	}{
 		// A file on the list of system files.
 		{".gitignore", matched(930120)},
@@ -271,7 +277,7 @@ func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testi
 	wantChange(t, crs, get("/?path=|cat%20/etc/passwd"), get("/?q=|cat%20/etc/passwd"),
 		matched(930120, 932160))
 	wantResult(t, crs, get("/?path=../../etc/passwd"),
-		waf.Result{RuleIDs: []int{930100, 930110}, Score: 20})
+		coreruleset.Result{RuleIDs: []int{930100, 930110}, Score: 20})
 	wantResult(t, crs, get("/?path=1'%20OR%20'1'='1"), matched(942100))
 }
 
@@ -341,7 +347,7 @@ func TestEmptyHeaderIsRead(t *testing.T) {
 
 	// An empty User-Agent is a notice, which adds 2.
 	wantResult(t, atDefaults(t), get("/", "User-Agent: "),
-		waf.Result{RuleIDs: []int{920330}, Score: 2})
+		coreruleset.Result{RuleIDs: []int{920330}, Score: 2})
 }
 
 func TestParanoiaLevel(t *testing.T) {
@@ -350,7 +356,7 @@ func TestParanoiaLevel(t *testing.T) {
 	// Accept-Charset is refused from paranoia level 2.
 	r := get("/", "Accept-Charset: utf-8")
 
-	wantResult(t, newCoreRuleSet(t, 1), r, waf.Result{})
+	wantResult(t, newCoreRuleSet(t, 1), r, coreruleset.Result{})
 	wantResult(t, newCoreRuleSet(t, 2), r, matched(920451))
 }
 
@@ -362,8 +368,8 @@ func TestEachDisabledRuleIsSwitchedOff(t *testing.T) {
 	r := request{http.MethodTrace, "/", []string{"Host: 192.0.2.1"}}
 
 	wantResult(t, newCoreRuleSet(t, 1), r,
-		waf.Result{RuleIDs: []int{911100, 920350}, Score: 8})
+		coreruleset.Result{RuleIDs: []int{911100, 920350}, Score: 8})
-	wantResult(t, newCoreRuleSet(t, 1, 920350, 911100), r, waf.Result{})
+	wantResult(t, newCoreRuleSet(t, 1, 920350, 911100), r, coreruleset.Result{})
 }
 
 func TestImagePushThatReusesALayerIsNotCheckedForCommandNames(t *testing.T) {
@@ -383,8 +389,8 @@ func TestImagePushThatReusesALayerIsNotCheckedForCommandNames(t *testing.T) {
 
 // withExclusions returns the Core Rule Set at the defaults, with the
 // exclusions file at path.
-func withExclusions(path string) (*waf.CoreRuleSet, error) {
+func withExclusions(path string) (*coreruleset.CoreRuleSet, error) {
-	return waf.New(waf.Params{
+	return coreruleset.New(coreruleset.Params{
 		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, ExclusionsFile: path,
 	})
 }
@@ -422,7 +428,7 @@ func TestExclusionsFileIsLoadedBeforeTheRules(t *testing.T) {
 func TestRuleSwitchedOffAndNamedInTheExclusionsFileIsOff(t *testing.T) {
 	t.Parallel()
 
-	crs, err := waf.New(waf.Params{
+	crs, err := coreruleset.New(coreruleset.Params{
 		ParanoiaLevel: 1, DisabledRules: []int{920500},
 		ExclusionsFile: exclusionsFile(t, backupFileExclusion),
 	})
@@ -430,7 +436,7 @@ func TestRuleSwitchedOffAndNamedInTheExclusionsFileIsOff(t *testing.T) {
 		t.Fatalf("load the exclusions: %v", err)
 	}
 
-	wantResult(t, crs, get("/notes.txt~"), waf.Result{})
+	wantResult(t, crs, get("/notes.txt~"), coreruleset.Result{})
 }
 
 func TestExclusionsFileMayNameAnyNumberInAComment(t *testing.T) {
@@ -550,6 +556,382 @@ func TestOrdinaryGiteaRequestsPassAndAttacksAreRefused(t *testing.T) {
 	}
 }
 
+// wpLogin is WordPress's sign-in path.
+const wpLogin = "/wp-login.php"
+
+// recordedRequest is a line of a file of recorded requests in testdata.
+type recordedRequest struct {
+	Method  string   `json:"method"`
+	Target  string   `json:"target"`
+	Headers []string `json:"headers"`
+	Body    string   `json:"body"`
+}
+
+// wordpressRequests returns the recorded ordinary WordPress requests in
+// testdata, each with its body.
+func wordpressRequests(t *testing.T) []recordedRequest {
+	t.Helper()
+
+	text, err := os.ReadFile(filepath.Join("testdata", "wordpress-requests.txt"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var requests []recordedRequest
+
+	for line := range strings.Lines(string(text)) {
+		if strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		var r recordedRequest
+
+		err := json.Unmarshal([]byte(line), &r)
+		if err != nil {
+			t.Fatalf("%q: %v", line, err)
+		}
+
+		requests = append(requests, r)
+	}
+
+	return requests
+}
+
+// readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
+// but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
+func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
+	t.Helper()
+
+	crs, err := coreruleset.New(coreruleset.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: 64<<10 - 1,
+	})
+	if err != nil {
+		t.Fatalf("load the Core Rule Set: %v", err)
+	}
+
+	return crs
+}
+
+// wordpressAttackTargets returns attack in a query parameter no exclusion
+// names, and in each field whose searches and names skip some rules there.
+func wordpressAttackTargets(attack string) []string {
+	return []string{
+		"/?id=" + attack,
+		wpLogin + "?id=" + attack,
+		"/wp-admin/admin-ajax.php?id=" + attack,
+		"/wp-json/wp/v2/posts?id=" + attack,
+		"/?s=" + attack,
+		"/index.php?s=" + attack,
+		"/page/2/?s=" + attack,
+		"/index.php/page/2/?s=" + attack,
+		"/wp-admin/edit.php?s=" + attack,
+		"/wp-admin/upload.php?s=" + attack,
+		"/wp-admin/plugin-install.php?s=" + attack,
+		"/wp-admin/edit-comments.php?s=" + attack,
+		"/wp-admin/users.php?s=" + attack,
+		"/wp-admin/plugins.php?s=" + attack,
+		"/wp-admin/edit-tags.php?s=" + attack,
+		"/wp-json/wp/v2/search?search=" + attack,
+		"/wp-json/wp/v2/posts?search=" + attack,
+		"/wp-json/wp/v2/tags?search=" + attack,
+		"/?rest_route=/wp/v2/search&search=" + attack,
+		"/wp-json/wp/v2/block-directory/search?term=" + attack,
+		"/wp-admin/themes.php?search=" + attack,
+		"/wp-admin/theme-install.php?search=" + attack,
+		"/wp-admin/upload.php?search=" + attack,
+		"/wp-admin/admin-ajax.php?q=" + attack,
+		"/wp-admin/admin-ajax.php?term=" + attack,
+		"/wp-admin/edit.php?_wp_http_referer=" + attack,
+		"/wp-admin/upload.php?_wp_http_referer=" + attack,
+		"/?tag=" + attack,
+		"/index.php?tag=" + attack,
+		"/wp-admin/edit.php?tag=" + attack,
+		"/wp-admin/edit.php?category_name=" + attack,
+		"/wp-admin/plugin-editor.php?file=" + attack,
+		"/wp-admin/theme-editor.php?file=" + attack,
+		"/wp-admin/plugin-editor.php?plugin=" + attack,
+		"/wp-admin/plugins.php?plugin=" + attack,
+		"/wp-admin/update.php?plugin=" + attack,
+	}
+}
+
+func TestOrdinaryWordPressRequestsPassAndAttacksAreRefused(t *testing.T) {
+	t.Parallel()
+
+	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
+
+	defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
+
+	for _, recorded := range wordpressRequests(t) {
+		r := request{recorded.Method, recorded.Target, recorded.Headers}
+
+		crsSets := []*coreruleset.CoreRuleSet{defaults}
+		if recorded.Body != "" {
+			crsSets = append(crsSets, bodies)
+		}
+
+		for _, crs := range crsSets {
+			got, _ := inspectBody(t, crs, r, recorded.Body)
+			if got.Score >= threshold {
+				t.Errorf("%s %s %.200q refused: %+v", r.method, r.target, recorded.Body, got)
+			}
+		}
+	}
+
+	for _, attack := range []string{
+		"1'%20OR%20'1'='1",
+		"..%2F..%2Fwp-config.php",
+		"%3Cscript%3Ealert(1)%3C%2Fscript%3E",
+	} {
+		for _, target := range wordpressAttackTargets(attack) {
+			if got := inspect(t, defaults, get(target)); got.Score < threshold {
+				t.Errorf("%s let through: %+v", target, got)
+			}
+		}
+
+		// In a body field no exclusion names, on the paths with exclusions.
+		body := "id=" + attack
+		for _, target := range []string{
+			wpLogin,
+			"/wp-comments-post.php",
+			"/wp-admin/admin-ajax.php",
+			"/wp-admin/post.php",
+			"/wp-admin/options.php",
+		} {
+			got, _ := inspectBody(t, bodies,
+				request{http.MethodPost, target, []string{formData}}, body)
+			if got.Score < threshold {
+				t.Errorf("POST %s %q let through: %+v", target, body, got)
+			}
+		}
+	}
+}
+
+// wordpressBlock is the comment that starts every block of WordPress's
+// HTML, which rule 941180 matches.
+const wordpressBlock = "<!-- wp:paragraph -->"
+
+// wordpressOverride is the header with which the block editor saves.
+const wordpressOverride = "X-HTTP-Method-Override: PUT"
+
+// wordpressRESTAddresses returns the four addresses of route on the REST
+// API.
+func wordpressRESTAddresses(route string) []string {
+	return []string{
+		"/wp-json" + route,
+		"/index.php/wp-json" + route,
+		"/index.php?rest_route=" + route,
+		"/?rest_route=" + route,
+	}
+}
+
+func TestWordPressExclusionsFollowEveryRESTAddress(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodiesUpTo64K(t)
+	content := `{"content":"` + wordpressBlock + `"}`
+
+	for _, route := range []string{
+		"/wp/v2/posts/1",
+		"/wp/v2/posts/1/autosaves",
+		"/wp/v2/pages/2",
+		"/wp/v2/templates/twentytwentyfive//index",
+		"/wp/v2/template-parts/twentytwentyfive//header",
+	} {
+		for _, address := range wordpressRESTAddresses(route) {
+			r := request{http.MethodPost, address, []string{jsonBody, wordpressOverride}}
+			wantBody(t, crs, r, content, coreruleset.Result{}, content)
+		}
+	}
+
+	// The routes that save something else keep the rules.
+	for _, route := range []string{
+		"/wp/v2/comments", "/wp/v2/users/1", "/wp/v2/settings",
+	} {
+		for _, address := range wordpressRESTAddresses(route) {
+			r := request{http.MethodPost, address, []string{jsonBody}}
+			wantBody(t, crs, r, content, matched(941180), content)
+		}
+	}
+
+	// WordPress follows a route in the query over one in the path.
+	r := request{
+		http.MethodPost, "/wp-json/wp/v2/posts/1?rest_route=/wp/v2/comments",
+		[]string{jsonBody},
+	}
+	wantBody(t, crs, r, content, matched(941180), content)
+}
+
+func TestWordPressSearchesAndFileNamesAreExcludedOnlyThere(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	wantChange(t, crs, get("/?s=python3"), get("/wp-admin/options.php?s=python3"),
+		matched(932260))
+	wantChange(t, crs, get("/?s=python3"), get("/?q=python3"), matched(932260))
+	wantChange(t, crs, get("/index.php?s=ls+-la"), get("/index.php?q=ls+-la"),
+		matched(932250))
+	wantChange(t, crs, get("/wp-json/wp/v2/search?search=powershell"),
+		get("/wp-json/example/v1/things?search=powershell"), matched(932120))
+	wantChange(t, crs, get("/index.php?rest_route=/wp/v2/search&search=powershell"),
+		get("/index.php?rest_route=/example/v1/things&search=powershell"), matched(932120))
+	wantChange(t, crs,
+		get("/wp-admin/plugin-editor.php?file=akismet%2Fviews%2Fconfig.php"),
+		get("/wp-admin/options.php?file=akismet%2Fviews%2Fconfig.php"), matched(930120))
+	wantChange(t, crs, get("/wp-admin/theme-editor.php?file=docker-compose.yml"),
+		get("/wp-admin/theme-editor.php?theme=docker-compose.yml"), matched(932260))
+}
+
+// TestWordPressOtherFieldsAreExcludedOnlyThere checks each field and rule
+// on one of its paths against the same value where no exclusion applies.
+func TestWordPressOtherFieldsAreExcludedOnlyThere(t *testing.T) {
+	t.Parallel()
+
+	const options = "/wp-admin/options.php"
+
+	crs := atDefaults(t)
+
+	for _, tt := range []struct {
+		target string
+		rule   int
+	}{
+		{"/page/2/?s=python3", 932260},
+		{"/page/2/?s=ls+-la", 932250},
+		{"/page/2/?s=powershell", 932120},
+		{"/index.php/page/2/?s=python3", 932260},
+		{"/?s=.htaccess", 930120},
+		{"/?s=wp-config.php", 930120},
+		{"/?s=.bashrc", 930120},
+		{"/page/2/?s=.htaccess", 930120},
+		{"/wp-admin/edit-comments.php?s=powershell", 932120},
+		{"/wp-admin/users.php?s=ls+-la", 932250},
+		{"/wp-admin/plugins.php?s=python3", 932260},
+		{"/wp-admin/edit-tags.php?s=python3", 932260},
+		{"/wp-admin/themes.php?search=powershell", 932120},
+		{"/wp-admin/theme-install.php?search=ls+-la", 932250},
+		{"/wp-admin/upload.php?search=python3", 932260},
+		{"/wp-admin/admin-ajax.php?q=powershell", 932120},
+		{"/wp-admin/admin-ajax.php?q=ls+-la", 932250},
+		{"/wp-admin/admin-ajax.php?q=python3", 932260},
+		{"/wp-admin/admin-ajax.php?term=powershell", 932120},
+		{"/wp-admin/admin-ajax.php?term=ls+-la", 932250},
+		{"/wp-admin/admin-ajax.php?term=python3", 932260},
+		{"/wp-admin/edit.php?_wp_http_referer=.htaccess", 930120},
+		{"/wp-admin/edit.php?_wp_http_referer=powershell", 932120},
+		{"/wp-admin/upload.php?_wp_http_referer=ls+-la", 932250},
+		{"/wp-admin/users.php?_wp_http_referer=python3", 932260},
+		{"/wp-admin/upload.php?_wp_http_referer=%2Fupload.php%3Fmode%3Dlist%26ps", 932340},
+		{"/?tag=python3", 932260},
+		{"/index.php?tag=powershell", 932120},
+		{"/wp-admin/edit.php?tag=ls+-la", 932250},
+		{"/wp-admin/edit.php?category_name=python3", 932260},
+		{"/wp-admin/edit.php?category_name=powershell", 932120},
+		{"/wp-admin/edit.php?category_name=ls+-la", 932250},
+		{"/wp-admin/plugin-editor.php?file=install-script.sh", 932120},
+		{"/wp-admin/theme-editor.php?file=document.write.js", 941180},
+		{"/wp-admin/plugin-editor.php?plugin=docker-helper", 932260},
+		{"/wp-admin/plugins.php?plugin=powershell-tools", 932120},
+		{"/wp-admin/update.php?plugin=docker-helper", 932260},
+	} {
+		_, query, _ := strings.Cut(tt.target, "?")
+		wantChange(t, crs, get(tt.target), get(options+"?"+query), matched(tt.rule))
+	}
+}
+
+// TestWordPressRESTFieldsAreExcludedOnlyThere checks search, term and the
+// header X-HTTP-Method-Override at the REST API's addresses.
+func TestWordPressRESTFieldsAreExcludedOnlyThere(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	// Any route of WordPress's own API, at each address.
+	for _, route := range []string{
+		"/wp/v2/tags", "/wp/v2/categories", "/wp/v2/pages", "/wp/v2/media",
+		"/wp/v2/users", "/wp/v2/blocks", "/wp/v2/pattern-directory/patterns",
+	} {
+		wantChange(t, crs, get("/wp-json"+route+"?search=python3"),
+			get("/wp-json/example/v1/things?search=python3"), matched(932260))
+		wantChange(t, crs, get("/index.php?rest_route="+route+"&search=python3"),
+			get("/index.php?rest_route=/example/v1/things&search=python3"), matched(932260))
+		wantChange(t, crs, get("/?rest_route="+route+"&search=.htaccess"),
+			get("/?rest_route=/example/v1/things&search=.htaccess"), matched(930120))
+	}
+
+	const directory = "/wp-json/wp/v2/block-directory/search"
+
+	wantChange(t, crs, get(directory+"?term=python3"),
+		get("/wp-json/wp/v2/tags?term=python3"), matched(932260))
+	wantChange(t, crs, get(directory+"?term=powershell"),
+		get("/wp-json/wp/v2/tags?term=powershell"), matched(932120))
+	wantChange(t, crs, get(directory+"?term=ls+-la"),
+		get("/wp-json/wp/v2/tags?term=ls+-la"), matched(932250))
+
+	// The header X-HTTP-Method-Override at the address on the site root,
+	// and off the REST API.
+	headers := []string{jsonBody, "Content-Length: 2", wordpressOverride}
+	wantChange(t, crs,
+		request{http.MethodPost, "/?rest_route=/wp/v2/posts/1", headers},
+		request{http.MethodPost, "/?p=1", headers}, matched(920450))
+}
+
+func TestWordPressBodyFieldsAreCheckedInTheQuery(t *testing.T) {
+	t.Parallel()
+
+	crs := atDefaults(t)
+
+	wantResult(t, crs, get(wpLogin+"?pwd=%2Fetc%2Fhosts"), matched(930120))
+	wantResult(t, crs, get(wpLogin+"?PWD=%2Fetc%2Fhosts"), matched(930120))
+	wantResult(t, crs, get("/wp-admin/admin-ajax.php?content=ls+-la"), matched(932250))
+	wantResult(t, crs, get("/wp-admin/admin-ajax.php?newcontent=%3Cstyle%3E"),
+		matched(941100, 941160))
+	wantResult(t, crs,
+		get("/wp-json/wp/v2/posts/1?json.content="+url.QueryEscape(wordpressBlock)),
+		matched(941180))
+}
+
+func TestWordPressExclusionsAreNarrow(t *testing.T) {
+	t.Parallel()
+
+	const (
+		save    = "/wp-json/wp/v2/posts/1"
+		offREST = "/api/posts/1"
+		length  = "Content-Length: 2"
+	)
+
+	crs := readingBodiesUpTo64K(t)
+	saving := request{http.MethodPost, save, []string{jsonBody, wordpressOverride}}
+
+	content := `{"content":"` + wordpressBlock + `"}`
+	wantBody(t, crs, saving, content, coreruleset.Result{}, content)
+
+	// The other fields of the post keep the rule, and so does the same field
+	// off the REST API.
+	title := `{"title":"` + wordpressBlock + `"}`
+	wantBody(t, crs, saving, title, matched(941180), title)
+	wantBody(t, crs, request{http.MethodPost, offREST, []string{jsonBody}}, content,
+		matched(941180), content)
+
+	// The header X-HTTP-Method-Override is refused off the REST API.
+	defaults := atDefaults(t)
+	wantResult(t, defaults,
+		request{http.MethodPost, save, []string{jsonBody, length, wordpressOverride}},
+		coreruleset.Result{})
+	wantResult(t, defaults,
+		request{http.MethodPost, offREST, []string{jsonBody, length, wordpressOverride}},
+		matched(920450))
+
+	// Signing in: pwd alone skips the list of system files.
+	signIn := request{http.MethodPost, wpLogin, []string{formData}}
+
+	body := "log=a&pwd=b%20%2Fetc%2Fhosts"
+	wantBody(t, crs, signIn, body, coreruleset.Result{}, body)
+
+	body = "log=b%20%2Fetc%2Fhosts&pwd=a"
+	wantBody(t, crs, signIn, body, matched(930120), body)
+}
+
 // bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
 const bodyLimit = 8 << 10
 
@@ -566,10 +948,10 @@ const injection = "1' OR '1'='1"
 
 // readingBodies returns the Core Rule Set as sww runs it by
 // default, but reading bodies up to bodyLimit.
-func readingBodies(t *testing.T) *waf.CoreRuleSet {
+func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
 	t.Helper()
 
-	crs, err := waf.New(waf.Params{
+	crs, err := coreruleset.New(coreruleset.Params{
 		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
 	})
 	if err != nil {
@@ -603,7 +985,8 @@ func padded(head, tail string, n int) string {
 // wantBody checks what crs finds in r with body, and that what it read of
 // body is read.
 func wantBody(
-	t *testing.T, crs *waf.CoreRuleSet, r request, body string, want waf.Result,
+	t *testing.T, crs *coreruleset.CoreRuleSet, r request, body string,
+	want coreruleset.Result,
 	read string,
 ) {
 	t.Helper()
@@ -627,7 +1010,7 @@ func TestBodiesAreReadOnlyWhileBodyLimitIsSet(t *testing.T) {
 		{jsonBody, `{"q":"` + injection + `"}`},
 		{xmlBody, "<q>" + injection + "</q>"},
 	} {
-		wantBody(t, off, post(tc.header), tc.body, waf.Result{}, "")
+		wantBody(t, off, post(tc.header), tc.body, coreruleset.Result{}, "")
 		wantBody(t, on, post(tc.header), tc.body, matched(942100), tc.body)
 	}
 }
@@ -650,7 +1033,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 	} {
 		wantBody(t, crs, post(tc.header), tc.attackFirst, matched(942100),
 			tc.attackFirst[:bodyLimit+1])
-		wantBody(t, crs, post(tc.header), tc.attackLast, waf.Result{},
+		wantBody(t, crs, post(tc.header), tc.attackLast, coreruleset.Result{},
 			tc.attackLast[:bodyLimit+1])
 	}
 
@@ -660,7 +1043,7 @@ func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
 	wantBody(t, crs, post(formData), atLimit, matched(930120, 932160), atLimit)
 
 	pastLimit := padded("pad=", "&q=/etc/passwd", bodyLimit+1)
-	wantBody(t, crs, post(formData), pastLimit, waf.Result{}, pastLimit)
+	wantBody(t, crs, post(formData), pastLimit, coreruleset.Result{}, pastLimit)
 }
 
 func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
@@ -676,7 +1059,7 @@ func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
 		wantBody(t, crs, post(tc.header), fits, matched(942100), fits)
 
 		larger := padded(tc.head, tc.tail, bodyLimit+1)
-		wantBody(t, crs, post(tc.header), larger, waf.Result{}, larger)
+		wantBody(t, crs, post(tc.header), larger, coreruleset.Result{}, larger)
 	}
 }
 
@@ -694,7 +1077,7 @@ func TestOtherBodiesAreNotRead(t *testing.T) {
 		"Content-Type: text/plain",
 		"Content-Type: application/x-git-receive-pack-request",
 	} {
-		wantBody(t, crs, post(header), body, waf.Result{}, "")
+		wantBody(t, crs, post(header), body, coreruleset.Result{}, "")
 	}
 }
 
@@ -722,8 +1105,8 @@ func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(t *testing.
 	// It is allowed on a body of any other kind, and on every body while no
 	// body is read.
 	fetch := "Content-Type: application/x-git-upload-pack-request"
-	wantBody(t, crs, post(fetch, gzip), "a", waf.Result{}, "")
+	wantBody(t, crs, post(fetch, gzip), "a", coreruleset.Result{}, "")
-	wantBody(t, atDefaults(t), post(formData, gzip), "a", waf.Result{}, "")
+	wantBody(t, atDefaults(t), post(formData, gzip), "a", coreruleset.Result{}, "")
 }
 
 func TestParametersGiteaSendsNamesInAreLeftOutAmongFormFieldsToo(t *testing.T) {
@@ -734,18 +1117,18 @@ func TestParametersGiteaSendsNamesInAreLeftOutAmongFormFieldsToo(t *testing.T) {
 
 	for _, tc := range []struct {
 		body string
-		want waf.Result
+		want coreruleset.Result
 	}{
-		{"path=.gitignore", waf.Result{}},
+		{"path=.gitignore", coreruleset.Result{}},
 		{"q=.gitignore", matched(930120)},
-		{"redirect_uri=" + local, waf.Result{}},
+		{"redirect_uri=" + local, coreruleset.Result{}},
 		{"next=" + local, matched(931100, 934110)},
 	} {
 		wantBody(t, crs, post(formData), tc.body, tc.want, tc.body)
 	}
 
 	body := field("path", ".gitignore") + end
-	wantBody(t, crs, post(multipart), body, waf.Result{}, body)
+	wantBody(t, crs, post(multipart), body, coreruleset.Result{}, body)
 
 	body = field("q", ".gitignore") + end
 	wantBody(t, crs, post(multipart), body, matched(930120), body)
@@ -869,7 +1252,7 @@ func TestCorazaWritesNoFile(t *testing.T) {
 func TestBodyLimitOf1GLoads(t *testing.T) {
 	t.Parallel()
 
-	_, err := waf.New(waf.Params{ParanoiaLevel: 1, BodyLimit: 1 << 30})
+	_, err := coreruleset.New(coreruleset.Params{ParanoiaLevel: 1, BodyLimit: 1 << 30})
 	if err != nil {
 		t.Errorf("load the Core Rule Set reading bodies up to 1G: %v", err)
 	}

internal/coreruleset/testdata/gitea-requests.txt

@@ -1,6 +1,6 @@
 # Ordinary gitea 1.27 requests that the Core Rule Set must let through at the
 # defaults. Each line is a path and query, and may end with one header after a
-# space. The tests of internal/waf inspect each as a GET. The Core Rule Set reads
+# space. The tests of internal/coreruleset inspect each as a GET. The Core Rule Set reads
 # the query and the headers the same way for any method.
 
 # Searches with ordinary words and symbols.

internal/coreruleset/testdata/wordpress-requests.txt

@@ -0,0 +1,403 @@
+# Ordinary WordPress 7.1.4 requests, one JSON object a line, that the Core Rule
+# Set must let through. Recorded from a browser and an API client, with the
+# password, the cookies that sign in, the contents of uploaded files and the
+# author of a plugin replaced.
+{"method": "GET", "target": "/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/install.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/css/dashicons.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/css/buttons.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/css/forms.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/css/dist/base-styles/admin-schemes.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/css/install.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/css/l10n.min.css?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/js/language-chooser.min.js?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/js/jquery/jquery.min.js?ver=3.7.1", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/wordpress-logo-gray.svg?ver=20260303", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/css/install.min.css?ver=7.1.4", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/spinner.gif", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/css/install.min.css?ver=7.1.4", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "POST", "target": "/wp-admin/install.php?step=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 9", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/install.php", "Accept-Encoding: gzip, deflate"], "body": "language="}
+{"method": "GET", "target": "/wp-includes/js/clipboard.min.js?ver=2.0.11", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php?step=1", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/js/underscore.min.js?ver=1.13.8", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php?step=1", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-includes/js/wp-util.min.js?ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/install.php?step=1", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203120.0892329216003417968750", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "GET", "target": "/2026/11/09/hello-world/", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close"], "body": ""}
+{"method": "POST", "target": "/wp-admin/install.php?step=2", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 203", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/install.php?step=1", "Accept-Encoding: gzip, deflate"], "body": "weblog_title=Example+Blog&user_name=editor1&admin_password=Tr0ub4dor%263-horse-staple%21&admin_password2=Tr0ub4dor%263-horse-staple%21&admin_email=editor1%40example.com&Submit=Install+WordPress&language="}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/fonts/manrope/Manrope-VariableFont_wght.woff2", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: */*", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?p=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?page_id=2", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/sample-page/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?cat=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/category/uncategorized/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/404-image.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/category/uncategorized/", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?m=202611", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/2026/11/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?author=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/author/editor1/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?feed=rss2", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/feed/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?feed=comments-rss2", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/comments/feed/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=hello", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=O%27Reilly+books", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=how+to+select+a+table+from+a+catalog", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=%22union+station%22+tickets", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=rock+%26+roll", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=cat+food", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=script+writing", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?s=one%2Ftwo", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/?paged=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/hello-world/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/search/hello/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-sitemap.xml", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-sitemap-index.xsl", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-sitemap.xml", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-sitemap-posts-post-1.xml", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-sitemap.xsl", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-sitemap-posts-post-1.xml", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/robots.txt", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-login.php?action=lostpassword", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,buttons,forms,l10n,wp-base-styles,wp-tooltip,login&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-login.php?action=lostpassword", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2F&reauth=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=clipboard,jquery-core,jquery-migrate,zxcvbn-async,wp-hooks&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2F&reauth=1", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "GET", "target": "/wp-admin/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "POST", "target": "/wp-comments-post.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 241", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/2026/11/09/hello-world/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": "comment=Nice+post%21+I%27d+add+that+select+wines+%26+cheese+go+well%3B+see+https%3A%2F%2Fexample.org%2Fx%3Fa%3D1.&author=Jo+Reader&email=jo%40example.com&url=https%3A%2F%2Fexample.org%2F&submit=Post+Comment&comment_post_ID=1&comment_parent=0"}
+{"method": "GET", "target": "/2026/11/09/hello-world/?unapproved=2&moderation-hash=c87857727b8aab5e31944f32f2f17826", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/2026/11/09/hello-world/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "POST", "target": "/wp-login.php?action=lostpassword", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 58", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-login.php?action=lostpassword", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": "user_login=editor1&redirect_to=&wp-submit=Get+New+Password"}
+{"method": "GET", "target": "/wp-login.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "POST", "target": "/wp-login.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 171", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-login.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": "log=editor1%40example.com&pwd=wrong%27+pass--+%3B+%22quoted%22+%3Cb%3E+%26+%2Fetc%2Fhosts&wp-submit=Log+In&redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2F&testcookie=1"}
+{"method": "POST", "target": "/wp-login.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 127", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-login.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": "log=editor1&pwd=Tr0ub4dor%263-horse-staple%21&wp-submit=Log+In&redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2F&testcookie=1"}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203150.3890221118927001953125", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=hoverIntent,wp-dom-ready,wp-hooks&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,site-health,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-poi&load%5Bchunk_1%5D=nter,widgets,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/users/me?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=wp-compression-test&test=1&_ajax_nonce=874d028d1a&1794203151554", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-includes/js/thickbox/loadingAnimation.gif", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=wp-compression-test&test=no&_ajax_nonce=874d028d1a&1794203151641", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 60", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": "_wpnonce=52dc4bc08a&timezone=UTC&action=get-community-events"}
+{"method": "GET", "target": "/wp-admin/index.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203150"], "body": ""}
+{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=dashboard-widgets&widget=dashboard_primary&pagenow=dashboard", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html, */*; q=0.01", "X-Requested-With: XMLHttpRequest", "Referer: http://blog.example/wp-admin/index.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203152"], "body": ""}
+{"method": "GET", "target": "/wp-admin/update-core.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203152"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-pointer,widgets&load%5Bchunk_1%5D=,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-theme,wp-components,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/update-core.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203153"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203153"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-pointer,widgets&load%5Bchunk_1%5D=,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203154"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 126", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203154"], "body": "data%5Bwp-check-locked-posts%5D%5B%5D=post-1&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-post&has_focus=true"}
+{"method": "GET", "target": "/wp-admin/post-new.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203154"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils,moxiejs,plupload&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,buttons,media-views,editor-buttons,wp-theme,wp-components,wp-preferences,wp-block-editor,wp-reusable-blocks,&load%5Bchunk_1%5D=wp-patterns,wp-media-utils,wp-editor,wp-base-styles,common,forms,wp-reset-editor-styles,wp-block-library,wp-block-editor-content&load%5Bchunk_2%5D=,wp-edit-blocks,wp-commands,wp-edit-post,wp-block-directory,wp-format-library,admin-menu,dashboard,list-tables,edit,revisions,me&load%5Bchunk_3%5D=dia,themes,about,nav-menus,wp-pointer,widgets,site-icon,l10n,wp-tooltip,wp-auth-check&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/users/me?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 118", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": "{\"meta\":{\"persisted_preferences\":{\"core\":{\"isComplementaryAreaVisible\":true},\"_modified\":\"2026-11-09T05:45:57.030Z\"}}}"}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=wp-polyfill&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=6&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/blocks?context=edit&per_page=100&page=1&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/wp_pattern_category?context=view&per_page=100&_fields=id%2Cname%2Cdescription%2Cslug&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?post_status=publish&post_type=post", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203155"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=hello&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203157"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-tags.php?taxonomy=category", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203158"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-tags.php?taxonomy=post_tag", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203159"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203160"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,buttons,media-views,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menu&load%5Bchunk_1%5D=s,wp-pointer,widgets,site-icon,l10n,wp-base-styles,wp-tooltip,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/upload.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203160"], "body": ""}
+{"method": "GET", "target": "/wp-includes/images/spinner.gif", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,buttons,media-views,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menu&load%5Bchunk_1%5D=s,wp-pointer,widgets,site-icon,l10n,wp-base-styles,wp-tooltip,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203160"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 128", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/upload.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203160"], "body": "action=query-attachments&post_id=0&query%5Borderby%5D=date&query%5Border%5D=DESC&query%5Bposts_per_page%5D=80&query%5Bpaged%5D=1"}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203160"], "body": ""}
+{"method": "GET", "target": "/wp-admin/media-new.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203161"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils,wp-dom-ready,wp-hooks&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/media-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203162"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=hoverIntent&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/media-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203162"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?post_type=page", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203162"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 171", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203163"], "body": "data%5Bwp-check-locked-posts%5D%5B%5D=post-3&data%5Bwp-check-locked-posts%5D%5B%5D=post-2&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-page&has_focus=true"}
+{"method": "GET", "target": "/wp-admin/post-new.php?post_type=page", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203163"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=8&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203164"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/block-patterns/patterns?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203164"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/users/me?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 158", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203164"], "body": "{\"meta\":{\"persisted_preferences\":{\"core\":{\"isComplementaryAreaVisible\":true},\"_modified\":\"2026-11-09T05:46:05.490Z\",\"core/edit-post\":{\"welcomeGuide\":false}}}}"}
+{"method": "GET", "target": "/wp-admin/edit-comments.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203164"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-comments.php?comment_status=moderated", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203165"], "body": ""}
+{"method": "GET", "target": "/wp-admin/themes.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203166"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/screenshot.png?ver=1.5", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/themes.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203167"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfour/screenshot.png?ver=1.6", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/themes.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203167"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentythree/screenshot.png?ver=1.7", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/themes.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203167"], "body": ""}
+{"method": "GET", "target": "/wp-admin/theme-install.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203167"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 73", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/theme-install.php?browse=popular", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203168"], "body": "request%5Bper_page%5D=100&request%5Bbrowse%5D=popular&action=query-themes"}
+{"method": "GET", "target": "/wp-admin/site-editor.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203168"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,wp-theme,wp-components,wp-preferences,wp-block-editor,wp-reusable-blocks,wp-patterns,wp-media-utils,wp-edito&load%5Bchunk_1%5D=r,wp-base-styles,common,forms,wp-reset-editor-styles,wp-block-library,wp-block-editor-content,wp-edit-blocks,wp-commands,wp-edit&load%5Bchunk_2%5D=-site,wp-format-library,buttons,media-views,wp-block-directory,admin-menu,dashboard,list-tables,edit,revisions,media,themes,abou&load%5Bchunk_3%5D=t,nav-menus,wp-pointer,widgets,site-icon,l10n,wp-tooltip,wp-auth-check&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203169"], "body": ""}
+{"method": "OPTIONS", "target": "/wp-json/wp/v2/settings?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203169"], "body": ""}
+{"method": "GET", "target": "/wp-admin/nav-menus.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203169"], "body": ""}
+{"method": "GET", "target": "/wp-admin/widgets.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203169"], "body": ""}
+{"method": "GET", "target": "/wp-admin/customize.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203169"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-pointer,widgets,site-icon&load%5Bchunk_1%5D=,l10n,wp-base-styles,wp-tooltip,buttons,customize-controls,customize-nav-menus,code-editor,media-views&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/customize.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203172"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,wp-hooks,underscore,wp-dom-ready&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/customize.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203172"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=heartbeat,customize-base,wp-util,customize-controls,backbone,wp-backbone,accordion,wp-sanitize,customize-nav-menus,imgareaselect&load%5Bchunk_1%5D=,customize-models,shortcode,media-models,wp-plupload&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/customize.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203172"], "body": ""}
+{"method": "GET", "target": "/?customize_changeset_uuid=45b3ef42-f34c-4dde-bde2-41c27b05accf&customize_theme=twentytwentyfive&customize_messenger_channel=preview-0", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/customize.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203172"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203172"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php?plugin_status=inactive", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203173"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203174"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?tab=popular", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203175"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=contact+form&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203178"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203180"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,code-editor,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-poi&load%5Bchunk_1%5D=nter,widgets,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203184"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils,wp-codemirror,underscore&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203184"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?plugin=akismet%2Fakismet.php&file=akismet%2Fakismet.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203184"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=akismet%2Fclass.akismet.php&plugin=akismet%2Fakismet.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203185"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203186"], "body": ""}
+{"method": "GET", "target": "/wp-admin/theme-editor.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203188"], "body": ""}
+{"method": "GET", "target": "/wp-admin/users.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203189"], "body": ""}
+{"method": "GET", "target": "/wp-admin/user-new.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203190"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-scripts.php?c=0&load%5Bchunk_0%5D=jquery-core,jquery-migrate,utils,zxcvbn-async&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/user-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203191"], "body": ""}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203193.0920450687408447265625", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "GET", "target": "/wp-admin/profile.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203191"], "body": ""}
+{"method": "GET", "target": "/wp-admin/users.php?s=editor&action=-1&new_role&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203192"], "body": ""}
+{"method": "GET", "target": "/wp-admin/tools.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203194"], "body": ""}
+{"method": "GET", "target": "/wp-admin/import.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203195"], "body": ""}
+{"method": "GET", "target": "/wp-admin/export.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203196"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/types/post?context=edit", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "X-WP-Nonce: b40ef802e6", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP Cookie check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203197; wp-settings-1=", "Connection: close"], "body": ""}
+{"method": "GET", "target": "/wp-admin/site-health.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203197"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp-site-health/v1/tests/dotorg-communication?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "X-WP-Nonce: b40ef802e6", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Referer: http://blog.example/wp-admin/site-health.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203198"], "body": ""}
+{"method": "GET", "target": "/wp-admin/site-health.php?tab=debug", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203198"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp-site-health/v1/directory-sizes", "headers": ["Host: blog.example", "Connection: keep-alive", "X-WP-Nonce: b40ef802e6", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Referer: http://blog.example/wp-admin/site-health.php?tab=debug", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203198"], "body": ""}
+{"method": "GET", "target": "/wp-admin/export-personal-data.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203198"], "body": ""}
+{"method": "GET", "target": "/wp-admin/erase-personal-data.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203200"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-general.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203201"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=media-views&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/options-general.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203202"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-writing.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203202"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-reading.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203203"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-discussion.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203204"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-media.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203205"], "body": ""}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203208.0107820034027099609375", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-permalink.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203206"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-privacy.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203207"], "body": ""}
+{"method": "GET", "target": "/wp-admin/about.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203209"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/about-release-badge.svg?ver=7.1", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/about.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203210"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/about-header-default.svg?ver=7.1", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-pointer,widgets&load%5Bchunk_1%5D=,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203210"], "body": ""}
+{"method": "GET", "target": "/wp-admin/credits.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203210"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/about-header-credits.svg?ver=7.1", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,common,forms,admin-menu,dashboard,list-tables,edit,revisions,media,themes,about,nav-menus,wp-pointer,widgets&load%5Bchunk_1%5D=,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-theme,wp-components,wp-commands&ver=7.1.4", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203211"], "body": ""}
+{"method": "GET", "target": "/wp-admin/freedoms.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203211"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/freedom-1.svg?ver=6.5", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/freedoms.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203212"], "body": ""}
+{"method": "GET", "target": "/wp-admin/images/freedom-2.svg?ver=6.5", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/freedoms.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203212"], "body": ""}
+{"method": "GET", "target": "/wp-admin/privacy.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203212"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=9&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/tags?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 20", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": "{\"name\":\"bob's tag\"}"}
+{"method": "GET", "target": "/wp-json/wp/v2/categories?search=a&per_page=20&_fields=id%2Cname&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=hello&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?per_page=10&_fields=id%2Ctitle&context=edit&status=draft%2Cpublish&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/block-types?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/themes?status=active&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/plugins?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/settings?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?post=1&per_page=5&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/pages?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 84", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": "{\"title\":\"An about page\",\"content\":\"<p>Our story &amp; more</p>\",\"status\":\"publish\"}"}
+{"method": "POST", "target": "/wp-json/wp/v2/settings?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 52", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": "{\"title\":\"Example Blog\",\"description\":\"Bob's words\"}"}
+{"method": "POST", "target": "/wp-json/wp/v2/users/me?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 63", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": "{\"description\":\"Writer of <em>things</em>; likes select wines\"}"}
+{"method": "GET", "target": "/wp-json/wp-site-health/v1/tests/background-updates?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "POST", "target": "/wp-cron.php", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Cookie: wordpress_test_cookie=WP Cookie check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215", "Connection: close", "Content-Length: 25", "Content-Type: application/x-www-form-urlencoded"], "body": "site-health=loopback-test"}
+{"method": "GET", "target": "/wp-json/wp-site-health/v1/tests/loopback-requests?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp-site-health/v1/tests/https-status?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/oembed/1.0/proxy?url=https%3A%2F%2Fexample.org%2Fvideo%2F123&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/url-details?url=https%3A%2F%2Fexample.org%2F&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/block-renderer/core/archives?context=edit&attributes%5BdisplayAsDropdown%5D=false&post_id=1&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203215"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=11&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/fonts/fira-code/FiraCode-VariableFont_wght.woff2", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: */*", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/templates/lookup?slug=single-post-bobs-first-post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": ""}
+{"method": "GET", "target": "/wp-content/uploads/2026/11/a.png", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/11/autosaves?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 968", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": "{\"status\":\"draft\",\"title\":\"Bob's first post: a guide\",\"excerpt\":\"a short summary\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\",\"meta\":{\"footnotes\":\"\"}}"}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/11?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 896", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=11&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": "{\"id\":11,\"slug\":\"bobs-first-post\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\"}"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 123", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=11&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": "data%5Bwp-refresh-post-lock%5D%5Bpost_id%5D=11&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=post&has_focus=true"}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203235.2958478927612304687500", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/11?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 890", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=11&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": "{\"id\":11,\"status\":\"publish\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\"}"}
+{"method": "GET", "target": "/wp-admin/post.php?post=11&action=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203220"], "body": ""}
+{"method": "GET", "target": "/?p=11", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203240"], "body": ""}
+{"method": "GET", "target": "/2026/11/09/bobs-first-post/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203240"], "body": ""}
+{"method": "GET", "target": "/?p=11&preview=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203240"], "body": ""}
+{"method": "GET", "target": "/wp-admin/revision.php?revision=12", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203240"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 58", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/revision.php?revision=12", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203248"], "body": "compare%5B%5D=12%3A11&action=get-revision-diffs&post_id=11"}
+{"method": "GET", "target": "/wp-admin/edit.php?post_type=wp_block", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203248"], "body": ""}
+{"method": "GET", "target": "/wp-admin/load-styles.php?c=0&dir=ltr&load%5Bchunk_0%5D=dashicons,admin-bar,wp-theme,wp-components,wp-list-reusable-blocks,common,forms,admin-menu,dashboard,list-tables,edit,revisions,&load%5Bchunk_1%5D=media,themes,about,nav-menus,wp-pointer,widgets,site-icon,l10n,wp-base-styles,wp-tooltip,buttons,wp-auth-check,wp-commands&ver=7.1.4", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/css,*/*;q=0.1", "Referer: http://blog.example/wp-admin/edit.php?post_type=wp_block", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203249"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 85", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php?post_type=wp_block", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203249"], "body": "interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-wp_block&has_focus=true"}
+{"method": "POST", "target": "/wp-admin/options-permalink.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 189", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-permalink.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203250"], "body": "_wpnonce=4c458d2a5d&_wp_http_referer=%2Fwp-admin%2Foptions-permalink.php&selection=%2F%25postname%25%2F&permalink_structure=%2F%25postname%25%2F&category_base=&tag_base=&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-permalink.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-permalink.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203250"], "body": ""}
+{"method": "GET", "target": "/wp-login.php?redirect_to=http%3A%2F%2Fblog.example%2Fwp-admin%2F", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203251"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=13&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/13/autosaves?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 968", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": "{\"status\":\"draft\",\"title\":\"Bob's first post: a guide\",\"excerpt\":\"a short summary\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\",\"meta\":{\"footnotes\":\"\"}}"}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/13?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 896", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=13&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": "{\"id\":13,\"slug\":\"bobs-first-post\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\"}"}
+{"method": "GET", "target": "/wp-json/wp/v2/templates/lookup?slug=single-post-bobs-first-post-2&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post.php?post=13&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 123", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=13&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": "data%5Bwp-refresh-post-lock%5D%5Bpost_id%5D=13&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=post&has_focus=true"}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203288.2769880294799804687500", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/posts/13?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 890", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=13&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": "{\"id\":13,\"status\":\"publish\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\nSELECT name FROM users WHERE id = 1;\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\\n\\n<!-- wp:shortcode -->\\n[gallery ids=\\\"1,2\\\"]\\n<!-- /wp:shortcode -->\\n\\n<!-- wp:image {\\\"id\\\":5,\\\"sizeSlug\\\":\\\"large\\\"} -->\\n<figure class=\\\"wp-block-image size-large\\\"><img src=\\\"http://blog.example/wp-content/uploads/2026/11/a.png\\\" alt=\\\"\\\" class=\\\"wp-image-5\\\"/></figure>\\n<!-- /wp:image -->\"}"}
+{"method": "GET", "target": "/wp-admin/post.php?post=13&action=edit", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203276"], "body": ""}
+{"method": "GET", "target": "/?p=13", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203292"], "body": ""}
+{"method": "GET", "target": "/bobs-first-post-2/", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203292"], "body": ""}
+{"method": "GET", "target": "/?p=13&preview=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203292"], "body": ""}
+{"method": "GET", "target": "/wp-admin/revision.php?revision=14", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203292"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 58", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/revision.php?revision=14", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203301"], "body": "compare%5B%5D=14%3A13&action=get-revision-diffs&post_id=13"}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=15&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203303"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=17&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/media?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 415", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAaeabRwojB6M1Wog", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "------WebKitFormBoundaryAaeabRwojB6M1Wog\r\nContent-Disposition: form-data; name=\"file\"; filename=\"holiday-photo.png\"\r\nContent-Type: image/png\r\n\r\nimage data\r\n------WebKitFormBoundaryAaeabRwojB6M1Wog\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nBob's picture\r\n------WebKitFormBoundaryAaeabRwojB6M1Wog\r\nContent-Disposition: form-data; name=\"alt_text\"\r\n\r\na small picture\r\n------WebKitFormBoundaryAaeabRwojB6M1Wog--\r\n"}
+{"method": "POST", "target": "/wp-json/wp/v2/media/18?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 53", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "{\"caption\":\"A caption\",\"description\":\"A description\"}"}
+{"method": "POST", "target": "/wp-json/wp/v2/media?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 409", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZ3NQqb5rHLeqDitl", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "------WebKitFormBoundaryZ3NQqb5rHLeqDitl\r\nContent-Disposition: form-data; name=\"file\"; filename=\"bin-day.png\"\r\nContent-Type: image/png\r\n\r\nimage data\r\n------WebKitFormBoundaryZ3NQqb5rHLeqDitl\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nBob's picture\r\n------WebKitFormBoundaryZ3NQqb5rHLeqDitl\r\nContent-Disposition: form-data; name=\"alt_text\"\r\n\r\na small picture\r\n------WebKitFormBoundaryZ3NQqb5rHLeqDitl--\r\n"}
+{"method": "POST", "target": "/wp-json/wp/v2/media/19?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 53", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "{\"caption\":\"A caption\",\"description\":\"A description\"}"}
+{"method": "POST", "target": "/wp-json/wp/v2/media?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 417", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryPj3tR1NjEw5stIqA", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "------WebKitFormBoundaryPj3tR1NjEw5stIqA\r\nContent-Disposition: form-data; name=\"file\"; filename=\"my passwd reset.png\"\r\nContent-Type: image/png\r\n\r\nimage data\r\n------WebKitFormBoundaryPj3tR1NjEw5stIqA\r\nContent-Disposition: form-data; name=\"title\"\r\n\r\nBob's picture\r\n------WebKitFormBoundaryPj3tR1NjEw5stIqA\r\nContent-Disposition: form-data; name=\"alt_text\"\r\n\r\na small picture\r\n------WebKitFormBoundaryPj3tR1NjEw5stIqA--\r\n"}
+{"method": "POST", "target": "/wp-json/wp/v2/media/20?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 53", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": "{\"caption\":\"A caption\",\"description\":\"A description\"}"}
+{"method": "GET", "target": "/wp-admin/media-new.php?browser-uploader", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203308"], "body": ""}
+{"method": "POST", "target": "/wp-admin/async-upload.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 778", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryFjx3GBevQOAuXrl5", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/media-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203310"], "body": "------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\nscan-01.png\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"post_id\"\r\n\r\n0\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"_wpnonce\"\r\n\r\n87ab0e0dbf\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"type\"\r\n\r\n\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"tab\"\r\n\r\n\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"short\"\r\n\r\n1\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5\r\nContent-Disposition: form-data; name=\"async-upload\"; filename=\"scan-01.png\"\r\nContent-Type: image/png\r\n\r\nimage data\r\n------WebKitFormBoundaryFjx3GBevQOAuXrl5--\r\n"}
+{"method": "POST", "target": "/wp-admin/async-upload.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 24", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/media-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203310"], "body": "attachment_id=21&fetch=3"}
+{"method": "GET", "target": "/wp-content/uploads/2026/11/scan-01.png", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/media-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203310"], "body": ""}
+{"method": "GET", "target": "/wp-content/uploads/2026/11/holiday-photo.png", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Referer: http://blog.example/wp-admin/upload.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203317"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?item=6", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203317"], "body": ""}
+{"method": "POST", "target": "/wp-admin/options.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 472", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-general.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203324"], "body": "option_page=general&action=update&_wpnonce=d9d12950f3&_wp_http_referer=%2Fwp-admin%2Foptions-general.php&blogname=Example+Blog&blogdescription=Bob%27s+words+%26+thoughts&site_icon=0&siteurl=http%3A%2F%2Fblog.example&home=http%3A%2F%2Fblog.example&new_admin_email=editor1%40example.com&default_role=subscriber&WPLANG=&timezone_string=UTC%2B0&date_format=F+j%2C+Y&date_format_custom=F+j%2C+Y&time_format=g%3Ai+a&time_format_custom=g%3Ai+a&start_of_week=1&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-general.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-general.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203324"], "body": ""}
+{"method": "POST", "target": "/wp-admin/options.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 197", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-reading.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203326"], "body": "option_page=reading&action=update&_wpnonce=1872e80cc5&_wp_http_referer=%2Fwp-admin%2Foptions-reading.php&show_on_front=posts&posts_per_page=12&posts_per_rss=10&rss_use_excerpt=0&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-reading.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-reading.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203326"], "body": ""}
+{"method": "POST", "target": "/wp-admin/options.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 616", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-discussion.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203328"], "body": "option_page=discussion&action=update&_wpnonce=1ac818c98b&_wp_http_referer=%2Fwp-admin%2Foptions-discussion.php&default_pingback_flag=1&default_ping_status=open&default_comment_status=open&require_name_email=1&close_comments_days_old=14&show_comments_cookies_opt_in=1&thread_comments=1&thread_comments_depth=5&comments_per_page=50&default_comments_page=newest&comment_order=asc&comments_notify=1&moderation_notify=1&wp_notes_notify=1&comment_previously_approved=1&comment_max_links=2&moderation_keys=buy+now%0D%0Acheap+watches&disallowed_keys=&show_avatars=1&avatar_rating=G&avatar_default=mystery&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-discussion.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-discussion.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203328"], "body": ""}
+{"method": "POST", "target": "/wp-admin/options.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 283", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-media.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203330"], "body": "option_page=media&action=update&_wpnonce=fe10b63129&_wp_http_referer=%2Fwp-admin%2Foptions-media.php&thumbnail_size_w=160&thumbnail_size_h=150&thumbnail_crop=1&medium_size_w=300&medium_size_h=300&large_size_w=1024&large_size_h=1024&uploads_use_yearmonth_folders=1&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-media.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-media.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203330"], "body": ""}
+{"method": "POST", "target": "/wp-admin/options.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 339", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-writing.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203332"], "body": "option_page=writing&action=update&_wpnonce=1e8037a08d&_wp_http_referer=%2Fwp-admin%2Foptions-writing.php&default_category=1&default_post_format=0&mailserver_url=mail.example.com&mailserver_port=110&mailserver_login=login%40example.com&mailserver_pass=&default_email_category=1&ping_sites=https%3A%2F%2Fexample.org%2Frpc&submit=Save+Changes"}
+{"method": "GET", "target": "/wp-admin/options-writing.php?settings-updated=true", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/options-writing.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203332"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 226", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit-tags.php?taxonomy=category", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203334"], "body": "action=add-tag&screen=edit-category&taxonomy=category&post_type=post&_wpnonce_add-tag=f99019c9ad&_wp_http_referer=%2Fwp-admin%2Fedit-tags.php%3Ftaxonomy%3Dcategory&tag-name=Food+%26+Drink&slug=food-drink&parent=-1&description="}
+{"method": "GET", "target": "/wp-admin/plugins.php?action=activate&plugin=akismet%2Fakismet.php&plugin_status=all&paged=1&s&_wpnonce=8b9b53e587", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203337"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php?activate=true&plugin_status=all&paged=1&s=", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203337"], "body": ""}
+{"method": "GET", "target": "/wp-admin/options-general.php?page=akismet-key-config&view=start", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203339"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php?action=activate&plugin=hello.php&plugin_status=all&paged=1&s&_wpnonce=5f6bf67faf", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203339"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?plugin=hello.php&file=hello.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203340"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 54", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-editor.php?plugin=hello.php&file=hello.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203342"], "body": "pointer=plugin_editor_notice&action=dismiss-wp-pointer"}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?plugin=hello.php&file=hello.php&wp_scrape_key=8e954aa3fcf28d6a7f8071208fa1b507&wp_scrape_nonce=743587269", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP Cookie check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203342", "Connection: close"], "body": ""}
+{"method": "GET", "target": "/?wp_scrape_key=8e954aa3fcf28d6a7f8071208fa1b507&wp_scrape_nonce=743587269", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP Cookie check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203342", "Connection: close"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 3611", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/plugin-editor.php?plugin=hello.php&file=hello.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203342"], "body": "nonce=ce99c3187f&_wp_http_referer=%2Fwp-admin%2Fplugin-editor.php%3Fplugin%3Dhello.php%26file%3Dhello.php&newcontent=%3C%3Fphp%0A%2F**%0A+*+%40package+Hello_Dolly%0A+*+%40version+1.7.2%0A+*%2F%0A%2F*%0APlugin+Name%3A+Hello+Dolly%0APlugin+URI%3A+http%3A%2F%2Fwordpress.org%2Fplugins%2Fhello-dolly%2F%0ADescription%3A+This+is+not+just+a+plugin%2C+it+symbolizes+the+hope+and+enthusiasm+of+an+entire+generation+summed+up+in+two+words+sung+most+famously+by+Louis+Armstrong%3A+Hello%2C+Dolly.+When+activated+you+will+randomly+see+a+lyric+from+%3Ccite%3EHello%2C+Dolly%3C%2Fcite%3E+in+the+upper+right+of+your+admin+screen+on+every+page.%0AAuthor%3A+Example+Author%0AVersion%3A+1.7.2%0AAuthor+URI%3A+http%3A%2F%2Fexample.com%2F%0AText+Domain%3A+hello-dolly%0A*%2F%0A%0A%2F%2F+Don't+load+directly.%0Aif+(+!+defined(+'ABSPATH'+)+)+%7B%0A%09exit%3B%0A%7D%0A%0Afunction+hello_dolly_get_lyric()+%7B%0A%09%2F**+These+are+the+lyrics+to+Hello+Dolly+*%2F%0A%09%24lyrics+%3D+%22Hello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AI+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+our+old+favorite+songs+from+way+back+when%0ASo%2C+take+her+wrap%2C+fellas%0ADolly%2C+never+go+away+again%0AHello%2C+Dolly%0AWell%2C+hello%2C+Dolly%0AIt's+so+nice+to+have+you+back+where+you+belong%0AYou're+lookin'+swell%2C+Dolly%0AI+can+tell%2C+Dolly%0AYou're+still+glowin'%2C+you're+still+crowin'%0AYou're+still+goin'+strong%0AI+feel+the+room+swayin'%0AWhile+the+band's+playin'%0AOne+of+our+old+favorite+songs+from+way+back+when%0ASo%2C+golly%2C+gee%2C+fellas%0AHave+a+little+faith+in+me%2C+fellas%0ADolly%2C+never+go+away%0APromise%2C+you'll+never+go+away%0ADolly'll+never+go+away+again%22%3B%0A%0A%09%2F%2F+Here+we+split+it+into+lines.%0A%09%24lyrics+%3D+explode(+%22%5Cn%22%2C+%24lyrics+)%3B%0A%0A%09%2F%2F+And+then+randomly+choose+a+line.%0A%09return+wptexturize(+%24lyrics%5B+mt_rand(+0%2C+count(+%24lyrics+)+-+1+)+%5D+)%3B%0A%7D%0A%0A%2F%2F+This+just+echoes+the+chosen+line%2C+we'll+position+it+later.%0Afunction+hello_dolly()+%7B%0A%09%24chosen+%3D+hello_dolly_get_lyric()%3B%0A%09%24lang+++%3D+''%3B%0A%09if+(+'en_'+!%3D%3D+substr(+get_user_locale()%2C+0%2C+3+)+)+%7B%0A%09%09%24lang+%3D+'+lang%3D%22en%22'%3B%0A%09%7D%0A%0A%09printf(%0A%09%09'%3Cp+id%3D%22dolly%22%3E%3Cspan+class%3D%22screen-reader-text%22%3E%25s+%3C%2Fspan%3E%3Cspan+dir%3D%22ltr%22%25s%3E%25s%3C%2Fspan%3E%3C%2Fp%3E'%2C%0A%09%09__(+'Quote+from+Hello+Dolly+song%2C+by+Jerry+Herman%3A'+)%2C%0A%09%09%24lang%2C%0A%09%09%24chosen%0A%09)%3B%0A%7D%0A%0A%2F%2F+Now+we+set+that+function+up+to+execute+when+the+admin_notices+action+is+called.%0Aadd_action(+'admin_notices'%2C+'hello_dolly'+)%3B%0A%0A%2F%2F+We+need+some+CSS+to+position+the+paragraph.%0Afunction+dolly_css()+%7B%0A%09echo+%22%0A%09%3Cstyle+type%3D'text%2Fcss'%3E%0A%09%23dolly+%7B%0A%09%09float%3A+right%3B%0A%09%09padding%3A+5px+10px%3B%0A%09%09margin%3A+0%3B%0A%09%09font-size%3A+12px%3B%0A%09%09line-height%3A+1.6666%3B%0A%09%7D%0A%09.rtl+%23dolly+%7B%0A%09%09float%3A+left%3B%0A%09%7D%0A%09.block-editor-page+%23dolly+%7B%0A%09%09display%3A+none%3B%0A%09%7D%0A%09%40media+screen+and+(max-width%3A+782px)+%7B%0A%09%09%23dolly%2C%0A%09%09.rtl+%23dolly+%7B%0A%09%09%09float%3A+none%3B%0A%09%09%09padding-left%3A+0%3B%0A%09%09%09padding-right%3A+0%3B%0A%09%09%7D%0A%09%7D%0A%09%3C%2Fstyle%3E%0A%09%22%3B%0A%7D%0A%0Aadd_action(+'admin_head'%2C+'dolly_css'+)%3B%0A&action=edit-theme-plugin-file&file=hello.php&plugin=hello.php&docs-list="}
+{"method": "GET", "target": "/wp-admin/theme-editor.php?file=style.css&theme=twentytwentyfive", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203342"], "body": ""}
+{"method": "GET", "target": "/wp-admin/themes.php?theme=twentytwentyfour", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203349"], "body": ""}
+{"method": "GET", "target": "/wp-admin/customize.php?return=%2Fwp-admin%2Fthemes.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203349"], "body": ""}
+{"method": "GET", "target": "/?customize_changeset_uuid=3a1c1c1e-e2b2-47ca-a042-c99fe3ad52dd&customize_theme=twentytwentyfive&customize_messenger_channel=preview-0", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/customize.php?return=%2Fwp-admin%2Fthemes.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203350"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 218", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "data%5Bwp-check-locked-posts%5D%5B%5D=post-13&data%5Bwp-check-locked-posts%5D%5B%5D=post-11&data%5Bwp-check-locked-posts%5D%5B%5D=post-1&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-post&has_focus=true"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 82", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "interval=60&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-post&has_focus=false"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 94", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=closed-postboxes&closed=dashboard_primary&hidden=&closedpostboxesnonce=0&page=dashboard"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 41", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=ajax-tag-search&tax=post_tag&q=bob"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 142", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=query-attachments&post_id=0&query%5Borderby%5D=date&query%5Border%5D=DESC&query%5Bposts_per_page%5D=80&query%5Bpaged%5D=1&_ajax_nonce=0"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 33", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=wp-compression-test&test=1"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 54", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=wp-link-ajax&search=hello&_ajax_linking_nonce=0"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 40", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "X-Requested-With: XMLHttpRequest", "Accept: */*", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "action=oembed-cache&post=1&_ajax_nonce=0"}
+{"method": "POST", "target": "/wp-cron.php?doing_wp_cron=1794203360.3913509845733642578125", "headers": ["Host: blog.example", "User-Agent: WordPress/7.1.4; http://blog.example", "Accept: */*", "Accept-Encoding: deflate, gzip, br, zstd", "Connection: close", "Content-Length: 0", "Content-Type: application/x-www-form-urlencoded"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 377", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203356"], "body": "post_title=Bob's+quick+title&post_name=bobs-first-post-2&mm=11&jj=09&aa=2026&hh=05&mn=48&ss=08&post_author=1&post_password=&post_category%5B%5D=0&post_category%5B%5D=1&tax_input%5Bpost_tag%5D=&comment_status=open&ping_status=open&_status=publish&_inline_edit=80b31520db&post_view=list&screen=edit-post&action=inline-save&post_type=post&post_ID=13&edit_date=true&post_status=all"}
+{"method": "POST", "target": "/wp-admin/profile.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 467", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/profile.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203362"], "body": "_wpnonce=931bec229d&_wp_http_referer=%2Fwp-admin%2Fprofile.php&from=profile&checkuser_id=1&color-nonce=1c207de10d&admin_color=modern&admin_bar_front=1&locale=site-default&user_login=editor1&first_name=Bob&last_name=&nickname=editor1&display_name=editor1&email=editor1%40example.com&url=http%3A%2F%2Fblog.example&description=I+write+about+%2Fetc%2F+and+%3Cem%3Ecats%3C%2Fem%3E.&pass1=&pass2=&new_application_password_name=&action=update&user_id=1&submit=Update+Profile"}
+{"method": "GET", "target": "/wp-admin/profile.php?updated=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/profile.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203362"], "body": ""}
+{"method": "POST", "target": "/wp-admin/user-new.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 293", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/user-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203364"], "body": "action=createuser&_wpnonce_create-user=0a10e6c68f&_wp_http_referer=%2Fwp-admin%2Fuser-new.php&user_login=author2&email=author2%40example.com&first_name=&last_name=&url=&pass1=Pw-for-author2-is-long%21&pass2=Pw-for-author2-is-long%21&send_user_notification=1&role=subscriber&createuser=Add+User"}
+{"method": "GET", "target": "/wp-admin/users.php?update=add&id=2", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/user-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203364"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 79", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit-comments.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203365"], "body": "_ajax_nonce=575b959a1d&action=dim-comment&id=2&dimClass=unapproved&new=approved"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 81", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit-comments.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203365"], "body": "_ajax_nonce=575b959a1d&action=dim-comment&id=2&dimClass=unapproved&new=unapproved"}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 358", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: */*", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit-comments.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203369"], "body": "newcomment_author=&newcomment_author_email=&newcomment_author_url=&action=replyto-comment&comment_ID=2&comment_post_ID=1&status=&position=-1&checkbox=1&mode=detail&_ajax_nonce-replyto-comment=465b2dff40&_wp_unfiltered_html_comment=8f43bb2d1f&content=Thanks%2C+Jo!+Try+%60ls+-la%60+and+%3Cb%3Ethen%3C%2Fb%3E+restart.&id=1&comments_listing=all&approve_parent=1"}
+{"method": "GET", "target": "/wp-admin/comment.php?action=editcomment&c=2", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203369"], "body": ""}
+{"method": "POST", "target": "/wp-admin/comment.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 613", "Upgrade-Insecure-Requests: 1", "Content-Type: application/x-www-form-urlencoded", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Origin: http://blog.example", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/comment.php?action=editcomment&c=2", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203373"], "body": "_wpnonce=e9770a5628&_wp_http_referer=%2Fwp-admin%2Fcomment.php%3Faction%3Deditcomment%26c%3D2&action=editedcomment&comment_ID=2&comment_post_ID=1&newcomment_author=Jo+Reader&newcomment_author_email=jo%40example.com&newcomment_author_url=https%3A%2F%2Fexample.org%2F&content=An+edited+comment%2C+it%27s+about+select+wines.&closedpostboxesnonce=b39bd4c73a&comment_status=1&mm=11&jj=09&aa=2026&hh=05&mn=45&ss=44&hidden_mm=11&cur_mm=11&hidden_jj=09&cur_jj=09&hidden_aa=2026&cur_aa=2026&hidden_hh=05&cur_hh=05&hidden_mn=45&cur_mn=49&comment_parent=0&save=Update&c=2&p=1&referredby=&_wp_original_http_referer=&noredir=1"}
+{"method": "GET", "target": "/wp-admin/edit-comments.php?p=1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/comment.php?action=editcomment&c=2", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203373"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=23&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203386"], "body": ""}
+{"method": "POST", "target": "/wp-admin/admin-ajax.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 263", "X-Requested-With: XMLHttpRequest", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, text/javascript, */*; q=0.01", "Content-Type: application/x-www-form-urlencoded; charset=UTF-8", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/edit.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203393"], "body": "data%5Bwp-check-locked-posts%5D%5B%5D=post-10&data%5Bwp-check-locked-posts%5D%5B%5D=post-16&data%5Bwp-check-locked-posts%5D%5B%5D=post-3&data%5Bwp-check-locked-posts%5D%5B%5D=post-2&interval=10&_nonce=f06ef15ba2&action=heartbeat&screen_id=edit-page&has_focus=true"}
+{"method": "GET", "target": "/wp-json/wp/v2/comments?context=edit&post=24&type=note&status=all&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/post-new.php?post_type=page", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/botany-flowers-closeup.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/red-hibiscus-closeup.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/grid-flower-2.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/campanula-alliariifolia-flower.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-content/themes/twentytwentyfive/assets/images/delphinium-flowers.webp", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: image/jxl,image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203394"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/template-parts/twentytwentyfive//header?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/template-parts/twentytwentyfive//footer?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?context=edit&offset=0&order=desc&orderby=date&per_page=3&ignore_sticky=false&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?context=edit&offset=0&order=desc&orderby=date&per_page=12&ignore_sticky=false&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/menus?context=view&per_page=100&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp-block-editor/v1/navigation-fallback?_embed=true&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/types/post?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/navigation?context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: b40ef802e6", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203398"], "body": ""}
+{"method": "GET", "target": "/?customize_changeset_uuid=f8b37173-205c-47cb-8499-41107f2fbe14&customize_theme=twentytwentyfive&customize_messenger_channel=preview-0", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/customize.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203401"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/users/me/application-passwords?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 28", "X-WP-Nonce: b40ef802e6", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: application/json, */*;q=0.1", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/profile.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432"], "body": "{\"name\":\"Example phone app\"}"}
+{"method": "GET", "target": "/wp-json/", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?per_page=5&search=hello", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/posts", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "content-type: application/json", "content-length: 77", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": "{\"title\": \"From the app\", \"content\": \"<p>It's a test</p>\", \"status\": \"draft\"}"}
+{"method": "GET", "target": "/wp-json/wp/v2/pages?slug=sample-page", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/users/me?context=edit", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/comments", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "content-type: application/json", "content-length: 102", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": "{\"post\": 1, \"content\": \"A note from the app\", \"author_name\": \"Bob\", \"author_email\": \"bob@example.com\"}"}
+{"method": "GET", "target": "/?rest_route=/wp/v2/posts&per_page=2", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/wp-json/oembed/1.0/embed?url=http%3A%2F%2Fblog.example%2Fhello-world%2F", "headers": ["user-agent: ExamplePublisher/1.0", "accept: */*", "accept-encoding: gzip,deflate,br", "Authorization: Basic ZWRpdG9yMTphYmNkIGVmZ2ggaWprbCBtbm9wIHFyc3QgdXZ3eA==", "cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203432", "Host: blog.example", "Connection: keep-alive"], "body": ""}
+{"method": "GET", "target": "/wp-login.php?action=logout&_wpnonce=e9a74137b6", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794203454"], "body": ""}
+{"method": "POST", "target": "/wp-json/wp/v2/templates/twentytwentyfive//index?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 169", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207357"], "body": "{\"id\":\"twentytwentyfive//index\",\"content\":\"<!-- wp:template-part {\\\"slug\\\":\\\"header\\\"} /-->\\n\\n<!-- wp:paragraph -->\\n<p>Our opening hours.</p>\\n<!-- /wp:paragraph -->\"}"}
+{"method": "POST", "target": "/wp-json/wp/v2/template-parts/twentytwentyfive//header?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 170", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/site-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207357"], "body": "{\"id\":\"twentytwentyfive//header\",\"content\":\"<!-- wp:template-part {\\\"slug\\\":\\\"header\\\"} /-->\\n\\n<!-- wp:paragraph -->\\n<p>Our opening hours.</p>\\n<!-- /wp:paragraph -->\"}"}
+{"method": "POST", "target": "/index.php?rest_route=%2Fwp%2Fv2%2Fposts%2F12&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 590", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207411"], "body": "{\"id\":12,\"title\":\"A guide to the plain address\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\",\"status\":\"draft\"}"}
+{"method": "POST", "target": "/index.php?rest_route=%2Fwp%2Fv2%2Fposts%2F12&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 553", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=12&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207411"], "body": "{\"id\":12,\"status\":\"publish\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\"}"}
+{"method": "POST", "target": "/index.php/wp-json/wp/v2/posts/14?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 590", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207416"], "body": "{\"id\":14,\"title\":\"A guide to the index address\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\",\"status\":\"draft\"}"}
+{"method": "POST", "target": "/index.php/wp-json/wp/v2/posts/14?_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 553", "X-WP-Nonce: c799cf7667", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/post.php?post=14&action=edit", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207416"], "body": "{\"id\":14,\"status\":\"publish\",\"content\":\"<!-- wp:paragraph -->\\n<p>It's a post about the Union station and how to select a table from the catalog &amp; more. Visit <a href=\\\"https://example.com/a?b=1&c=2\\\">the page</a>.</p>\\n<!-- /wp:paragraph -->\\n\\n<!-- wp:code -->\\n<pre class=\\\"wp-block-code\\\"><code>curl -s https://example.org/install | sh\\ncat /etc/hosts</code></pre>\\n<!-- /wp:code -->\\n\\n<!-- wp:html -->\\n<iframe src=\\\"https://example.org/embed\\\" onload=\\\"console.log('ok')\\\"></iframe>\\n<script>document.title = 'x';</script>\\n<!-- /wp:html -->\"}"}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=akismet%2Fviews%2Fconfig.php&plugin=akismet%2Fakismet.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=example-plugin%2Fbin%2Finstall.sh&plugin=example-plugin%2Fexample-plugin.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207404"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=example-plugin%2Fdocker-compose.yml&plugin=example-plugin%2Fexample-plugin.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207406"], "body": ""}
+{"method": "GET", "target": "/wp-admin/theme-editor.php?file=inc%2Fconfig.php&theme=example-theme", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207407"], "body": ""}
+{"method": "GET", "target": "/?s=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207357"], "body": ""}
+{"method": "GET", "target": "/index.php?s=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207357"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=python3&post_status=all&post_type=post&_wpnonce=3a4f1df05d&_wp_http_referer=%2Fwp-admin%2Fedit.php&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207365"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=python3&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207365"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter=&s=python3&_wpnonce=f27c858c25&_wp_http_referer=%2Fwp-admin%2Fupload.php%3Fmode%3Dlist&action=-1&affected=&_ajax_nonce=a654b3ca7f&ps=", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207366"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter&s=python3&action=-1&affected&_ajax_nonce=a654b3ca7f&ps", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207366"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=python3&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207366"], "body": ""}
+{"method": "GET", "target": "/?s=powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207368"], "body": ""}
+{"method": "GET", "target": "/index.php?s=powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207368"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=powershell&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207373"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter&s=powershell&action=-1&affected&_ajax_nonce=a654b3ca7f&ps", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207375"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=powershell&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207375"], "body": ""}
+{"method": "GET", "target": "/?s=sudo+apt+install+nginx", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207378"], "body": ""}
+{"method": "GET", "target": "/index.php?s=sudo+apt+install+nginx", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207378"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=sudo+apt+install+nginx&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207383"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter&s=sudo+apt+install+nginx&action=-1&affected&_ajax_nonce=a654b3ca7f&ps", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207384"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=sudo+apt+install+nginx&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207385"], "body": ""}
+{"method": "GET", "target": "/?s=chmod+%2Bx", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207386"], "body": ""}
+{"method": "GET", "target": "/index.php?s=chmod+%2Bx", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207386"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=chmod+%2Bx&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207390"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter&s=chmod+%2Bx&action=-1&affected&_ajax_nonce=a654b3ca7f&ps", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207391"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=chmod+%2Bx&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207391"], "body": ""}
+{"method": "GET", "target": "/?s=ls+-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207394"], "body": ""}
+{"method": "GET", "target": "/index.php?s=ls+-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207394"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=ls+-la&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207397"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter&s=ls+-la&action=-1&affected&_ajax_nonce=a654b3ca7f&ps", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207398"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-install.php?s=ls+-la&tab=search&type=term", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207399"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=python3&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?search=python3&per_page=20&context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=powershell&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?search=powershell&per_page=20&context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=sudo%20apt%20install%20nginx&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?search=sudo%20apt%20install%20nginx&per_page=20&context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=chmod%20%2Bx&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?search=chmod%20%2Bx&per_page=20&context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=ls%20-la&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/posts?search=ls%20-la&per_page=20&context=edit&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: c799cf7667", "Referer: http://blog.example/wp-admin/post-new.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794207402"], "body": ""}
+{"method": "GET", "target": "/wp-login.php?loggedout=true&wp_lang=en_US", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check"], "body": ""}
+{"method": "GET", "target": "/page/2/?s=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/?s=python3", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/page/2/?s=ls+-la", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/?s=ls+-la", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/page/2/?s=powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/?s=powershell", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/index.php/page/2/?s=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/index.php/?s=python3", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209938"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?mode=list&attachment-filter=&s=hello&_wpnonce=c7d3be7361&_wp_http_referer=%2Fwp-admin%2Fupload.php%3Fmode%3Dlist%26attachment-filter%26s%3Dpython3%26action%3D-1%26affected%26_ajax_nonce%3Dac194defea%26ps&action=-1&affected=&_ajax_nonce=ac194defea&ps=", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php?mode=list&attachment-filter&s=python3&action=-1&affected&_ajax_nonce=ac194defea&ps", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209922"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=hello&post_status=all&post_type=post&_wpnonce=845fd30495&_wp_http_referer=%2Fwp-admin%2Fedit.php%3Fs%3Dpowershell%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D0%26paged%3D1%26action2%3D-1&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=powershell&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209923"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=hello&post_status=all&post_type=post&_wpnonce=845fd30495&_wp_http_referer=%2Fwp-admin%2Fedit.php%3Fs%3Dls%2B-la%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D0%26paged%3D1%26action2%3D-1&action=-1&m=0&cat=0", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=ls+-la&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209924"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?s=hello&post_status=all&post_type=post&_wpnonce=845fd30495&_wp_http_referer=%2Fwp-admin%2Fedit.php%3Fs%3D.htaccess%26post_status%3Dall%26post_type%3Dpost%26action%3D-1%26m%3D0%26cat%3D0%26paged%3D1%26action2%3D-1&action=-1&m=0&cat=0&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php?s=.htaccess&post_status=all&post_type=post&action=-1&m=0&cat=0&paged=1&action2=-1", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209925"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-comments.php?s=hello&comment_status=all&pagegen_timestamp=2026-11-09+07%3A38%3A46&_total=0&_per_page=20&_page=1&paged=1&_ajax_fetch_list_nonce=0b1db04b0a&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php%3Fs%3Dpython3%26comment_status%3Dall%26pagegen_timestamp%3D2026-11-09%2B07%253A38%253A46%26_total%3D1%26_per_page%3D20%26_page%3D1%26_ajax_fetch_list_nonce%3D0b1db04b0a%26action%3D-1%26comment_type%26paged%3D1%26action2%3D-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit-comments.php?s=python3&comment_status=all&pagegen_timestamp=2026-11-09+07%3A38%3A46&_total=1&_per_page=20&_page=1&_ajax_fetch_list_nonce=0b1db04b0a&action=-1&comment_type&paged=1&action2=-1", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209926"], "body": ""}
+{"method": "GET", "target": "/wp-admin/users.php?s=hello&_wpnonce=63da9c4bb8&_wp_http_referer=%2Fwp-admin%2Fusers.php%3Fs%3Dpython3%26action%3D-1%26new_role%26paged%3D1%26action2%3D-1%26new_role2&action=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/users.php?s=python3&action=-1&new_role&paged=1&action2=-1&new_role2", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209927"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-comments.php?s=python3&comment_status=all&pagegen_timestamp=2026-11-09+07%3A38%3A46&_total=1&_per_page=20&_page=1&_ajax_fetch_list_nonce=0b1db04b0a&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php&_wpnonce=21dd43bdf4&_wp_http_referer=%2Fwp-admin%2Fedit-comments.php&action=-1&comment_type=&paged=1&action2=-1", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit-comments.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209926"], "body": ""}
+{"method": "GET", "target": "/wp-admin/users.php?s=python3&_wpnonce=63da9c4bb8&_wp_http_referer=%2Fwp-admin%2Fusers.php&action=-1&new_role=&paged=1&action2=-1&new_role2=", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/users.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209927"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php?s=python3&plugin_status=all", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugins.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209929"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit-tags.php?taxonomy=post_tag&post_type=post&s=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit-tags.php?taxonomy=post_tag", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209928"], "body": ""}
+{"method": "GET", "target": "/wp-admin/themes.php?search=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/themes.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209929"], "body": ""}
+{"method": "GET", "target": "/wp-admin/theme-install.php?search=python3&browse=popular", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/theme-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209929"], "body": ""}
+{"method": "GET", "target": "/wp-admin/upload.php?search=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/upload.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209929"], "body": ""}
+{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=ajax-tag-search&tax=post_tag&q=python3&number=20", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "X-Requested-With: XMLHttpRequest", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209930"], "body": ""}
+{"method": "GET", "target": "/wp-admin/admin-ajax.php?action=autocomplete-user&term=python3&autocomplete_type=add", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: */*", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209930"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/tags?per_page=20&orderby=count&order=desc&_fields=id%2Cname&search=python3&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/categories?per_page=20&_fields=id%2Cname&search=python3&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/pages?search=python3&per_page=20&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/media?search=python3&per_page=20&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/users?search=python3&per_page=20&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/blocks?search=python3&per_page=20&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/pattern-directory/patterns?search=python3&per_page=20&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/block-directory/search?term=python3&per_page=10&page=1&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/?tag=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/?p=16", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209919"], "body": ""}
+{"method": "GET", "target": "/?tag=powershell", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209919"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?tag=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209934"], "body": ""}
+{"method": "GET", "target": "/wp-admin/edit.php?category_name=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/edit.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209935"], "body": ""}
+{"method": "GET", "target": "/?s=.htaccess", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/?s=wp-config.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/?s=.bashrc", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-json/wp/v2/search?search=.htaccess&per_page=20&type=post&_locale=user", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209939"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=example-plugin%2Finstall-script.sh&plugin=example-plugin%2Fexample-plugin.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209935"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=example-plugin%2Fscripts%2Fpowershell-setup.ps1&plugin=example-plugin%2Fexample-plugin.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209936"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?file=example-plugin%2Fassets%2Fdocument.write.js&plugin=example-plugin%2Fexample-plugin.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209936"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?plugin=docker-helper%2Fdocker-helper.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209936"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugin-editor.php?plugin=powershell-tools%2Fpowershell-tools.php", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-editor.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209936"], "body": ""}
+{"method": "GET", "target": "/wp-admin/plugins.php?action=deactivate&plugin=docker-helper%2Fdocker-helper.php&plugin_status=all&paged=1&s&_wpnonce=6a63c44dbf", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugins.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209937"], "body": ""}
+{"method": "GET", "target": "/wp-admin/update.php?action=install-plugin&plugin=docker-helper&_wpnonce=6f3e7b77ac", "headers": ["Host: blog.example", "Connection: keep-alive", "Upgrade-Insecure-Requests: 1", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Referer: http://blog.example/wp-admin/plugin-install.php", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209937"], "body": ""}
+{"method": "GET", "target": "/?rest_route=/wp/v2/search&search=python3", "headers": ["Host: blog.example", "Connection: keep-alive", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-WP-Nonce: 3e816ac72c", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209921"], "body": ""}
+{"method": "POST", "target": "/?rest_route=/wp/v2/posts/1", "headers": ["Host: blog.example", "Connection: keep-alive", "Content-Length: 40", "X-WP-Nonce: 3e816ac72c", "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/156.0.8078.4 Safari/537.36", "Accept: application/json, */*;q=0.1", "X-HTTP-Method-Override: PUT", "Content-Type: application/json", "Origin: http://blog.example", "Referer: http://blog.example/wp-admin/", "Accept-Encoding: gzip, deflate", "Cookie: wordpress_test_cookie=WP%20Cookie%20check; wordpress_logged_in_8f08caa83939d4856f3c9b1fa17104b4=editor1%7C1893456000%7Cabcdefghijklmnopqrstuvwxyz0123456789ABCDEFG%7C0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef; wp-settings-time-1=1794209921"], "body": "{\"id\":1,\"title\":\"Hello from the editor\"}"}

internal/coreruleset/wordpress.conf

@@ -0,0 +1,223 @@
+# The ninth change: on WordPress's paths, some fields skip the rules that refused
+# ordinary WordPress requests there. Each exclusion runs with the request, before
+# the rules it switches off, so this file is loaded before the Core Rule Set's
+# rules. Each comment names a request the rule refused. An exclusion on a field
+# of a body applies only when the query has no parameter of that name, so it
+# matters only while SWW_WAF_BODY_LIMIT is set.
+
+# WordPress takes a call to its REST API at any of four addresses:
+#   /wp-json/wp/v2/posts/1
+#   /index.php/wp-json/wp/v2/posts/1
+#   /index.php?rest_route=/wp/v2/posts/1
+#   /?rest_route=/wp/v2/posts/1
+# These two rules put the route, here /wp/v2/posts/1, in tx.rest_route for the
+# exclusions below. A call that names a route in both its path and its query
+# gets none of them, since WordPress follows the query.
+SecRule &ARGS_GET:rest_route "@eq 0" "id:900705,phase:1,pass,nolog,chain"
+    SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?wp-json(/.*)$" \
+        "capture,setvar:tx.rest_route=%{tx.1}"
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php)?$" "id:900706,phase:1,pass,nolog,chain"
+    SecRule ARGS_GET:rest_route "@rx ^(/.*)$" "capture,setvar:tx.rest_route=%{tx.1}"
+
+# The block editor saves a post with POST and the header X-HTTP-Method-Override:
+# PUT, which the Core Rule Set refused (920450). So does saving a user's editor
+# preferences.
+SecRule TX:rest_route "@beginsWith /" \
+    "id:900700,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=920450;REQUEST_HEADERS_NAMES:X-HTTP-Method-Override"
+
+# The block editor and the site editor send HTML in the JSON field content, which
+# skips these rules when saving or autosaving a post, a page, a template or a
+# template part:
+#   930120: cat /etc/hosts
+#   932230: a code block with a shell pipeline and an SQL query
+#   932250: the same code block
+#   934100: console.log('ok')
+#   941100: <iframe src="..." onload="...">
+#   941110: <script>
+#   941120: onload=
+#   941160: <img src=
+#   941180: <!-- wp:paragraph -->, the comment that starts every block
+#   941390: console.log(
+#   942190: how to select a table from the catalog
+#   942270: how to select a table from the catalog
+SecRule TX:rest_route \
+    "@rx ^/wp/v2/(?:(?:posts|pages)(?:/[0-9]+(?:/autosaves)?)?|template(?:s|-parts)(?:/[^/]+//[^/]+(?:/autosaves)?)?)$" \
+    "id:900701,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:json.content "@eq 0" \
+        "ctl:ruleRemoveTargetById=930120;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=932230;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=932250;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=934100;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941100;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941110;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941120;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941160;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941180;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=941390;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=942190;ARGS:json.content,\
+        ctl:ruleRemoveTargetById=942270;ARGS:json.content"
+
+# A reply to a comment from the list of comments, in content:
+#   932125: ls -la, in the reply's text
+#   932230: ls -la, in the reply's text
+#   932250: ls -la, in the reply's text
+SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
+    "id:900702,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:content "@eq 0" \
+        "ctl:ruleRemoveTargetById=932125;ARGS:content,\
+        ctl:ruleRemoveTargetById=932230;ARGS:content,\
+        ctl:ruleRemoveTargetById=932250;ARGS:content"
+
+# Saving a plugin's or a theme's file from its file editor sends the file in
+# newcontent, which skips these rules, each of which refused saving the plugin
+# Hello Dolly's hello.php. Some of them refused only the whole file:
+#   932140: if ( 'en_' !== substr(
+#   932235: the whole file
+#   933100: the whole file
+#   933160: if ( 'en_' !== substr(
+#   933210: $lyrics = explode(
+#   941100: <style type='text/css'>
+#   941160: <style type='text/css'>
+#   941190: the whole file
+#   942151: if ( 'en_' !== substr(
+#   942540: Dolly'll never go away again";
+SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
+    "id:900703,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:newcontent "@eq 0" \
+        "ctl:ruleRemoveTargetById=932140;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=932235;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=933100;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=933160;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=933210;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=941100;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=941160;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=941190;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=942151;ARGS:newcontent,\
+        ctl:ruleRemoveTargetById=942540;ARGS:newcontent"
+
+# Signing in, in pwd, where a password holds any characters:
+#   930120: a password ending in /etc/hosts
+SecRule REQUEST_FILENAME "@streq /wp-login.php" \
+    "id:900704,phase:1,pass,nolog,chain"
+    SecRule &ARGS_GET:pwd "@eq 0" "ctl:ruleRemoveTargetById=930120;ARGS:pwd"
+
+# WordPress's searches for posts, media and plugins, and the later pages of a
+# search of the site, send the text searched for in s, which skips these rules
+# there:
+#   930120: .htaccess
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+SecRule REQUEST_FILENAME \
+    "@rx ^/(?:(?:index\.php/)?page/[0-9]+/?|index\.php|wp-admin/(?:edit|upload|plugin-install)\.php)?$" \
+    "id:900707,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:s,\
+    ctl:ruleRemoveTargetById=932120;ARGS:s,\
+    ctl:ruleRemoveTargetById=932250;ARGS:s,\
+    ctl:ruleRemoveTargetById=932260;ARGS:s"
+
+# The REST API's searches send it in search, on every route of WordPress's own
+# API, which skips the same rules there.
+SecRule TX:rest_route "@beginsWith /wp/v2/" \
+    "id:900708,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:search,\
+    ctl:ruleRemoveTargetById=932120;ARGS:search,\
+    ctl:ruleRemoveTargetById=932250;ARGS:search,\
+    ctl:ruleRemoveTargetById=932260;ARGS:search"
+
+# The plugin and theme file editors name the file open in file, which skips
+# these rules there:
+#   930120: akismet/views/config.php
+#   932120: install-script.sh
+#   932160: bin/install.sh
+#   932260: docker-compose.yml
+#   941180: document.write.js
+SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin|theme)-editor\.php$" \
+    "id:900709,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:file,\
+    ctl:ruleRemoveTargetById=932120;ARGS:file,\
+    ctl:ruleRemoveTargetById=932160;ARGS:file,\
+    ctl:ruleRemoveTargetById=932260;ARGS:file,\
+    ctl:ruleRemoveTargetById=941180;ARGS:file"
+
+# The plugin file editor and the links to activate, deactivate and install a
+# plugin name it in plugin, which skips these rules there:
+#   932120: powershell-tools/powershell-tools.php
+#   932260: docker-helper/docker-helper.php
+SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:plugin-editor|plugins|update)\.php$" \
+    "id:900710,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:plugin,\
+    ctl:ruleRemoveTargetById=932260;ARGS:plugin"
+
+# The list pages of wp-admin send their own address in _wp_http_referer, so the
+# next search, filter or bulk action repeats the last search, which skips these
+# rules there:
+#   930120: .htaccess
+#   932120: powershell
+#   932235: python3
+#   932250: ls -la
+#   932260: python3
+#   932340: &ps, the end of the media list's own address
+SecRule REQUEST_FILENAME \
+    "@rx ^/wp-admin/(?:edit|edit-comments|edit-tags|plugin-install|plugins|theme-install|themes|upload|users)\.php$" \
+    "id:900711,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=930120;ARGS:_wp_http_referer,\
+    ctl:ruleRemoveTargetById=932120;ARGS:_wp_http_referer,\
+    ctl:ruleRemoveTargetById=932235;ARGS:_wp_http_referer,\
+    ctl:ruleRemoveTargetById=932250;ARGS:_wp_http_referer,\
+    ctl:ruleRemoveTargetById=932260;ARGS:_wp_http_referer,\
+    ctl:ruleRemoveTargetById=932340;ARGS:_wp_http_referer"
+
+# The rules below refused the text searched for, or a name:
+#   932120: powershell
+#   932250: ls -la
+#   932260: python3
+# Each request skips them in the field that holds that text.
+
+# wp-admin's searches of comments, users, plugins and tags, in s.
+SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:edit-comments|users|plugins|edit-tags)\.php$" \
+    "id:900712,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:s,\
+    ctl:ruleRemoveTargetById=932250;ARGS:s,\
+    ctl:ruleRemoveTargetById=932260;ARGS:s"
+
+# wp-admin's searches of themes and of the media library's grid, in search.
+SecRule REQUEST_FILENAME "@rx ^/wp-admin/(?:themes|theme-install|upload)\.php$" \
+    "id:900713,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:search,\
+    ctl:ruleRemoveTargetById=932250;ARGS:search,\
+    ctl:ruleRemoveTargetById=932260;ARGS:search"
+
+# The tag field of the classic editor, in q, and the search for a user to add,
+# in term.
+SecRule REQUEST_FILENAME "@streq /wp-admin/admin-ajax.php" \
+    "id:900714,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:q,\
+    ctl:ruleRemoveTargetById=932250;ARGS:q,\
+    ctl:ruleRemoveTargetById=932260;ARGS:q,\
+    ctl:ruleRemoveTargetById=932120;ARGS:term,\
+    ctl:ruleRemoveTargetById=932250;ARGS:term,\
+    ctl:ruleRemoveTargetById=932260;ARGS:term"
+
+# The REST API's search of the block directory, in term.
+SecRule TX:rest_route "@streq /wp/v2/block-directory/search" \
+    "id:900715,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:term,\
+    ctl:ruleRemoveTargetById=932250;ARGS:term,\
+    ctl:ruleRemoveTargetById=932260;ARGS:term"
+
+# A tag's address with the Plain permalink setting, and the link on a tag in the
+# list of posts, in tag.
+SecRule REQUEST_FILENAME "@rx ^/(?:index\.php|wp-admin/edit\.php)?$" \
+    "id:900716,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:tag,\
+    ctl:ruleRemoveTargetById=932250;ARGS:tag,\
+    ctl:ruleRemoveTargetById=932260;ARGS:tag"
+
+# The link on a category in the list of posts, in category_name.
+SecRule REQUEST_FILENAME "@streq /wp-admin/edit.php" \
+    "id:900717,phase:1,pass,nolog,\
+    ctl:ruleRemoveTargetById=932120;ARGS:category_name,\
+    ctl:ruleRemoveTargetById=932250;ARGS:category_name,\
+    ctl:ruleRemoveTargetById=932260;ARGS:category_name"

internal/discriminator/abuseipdb.go

@@ -50,7 +50,7 @@ func (abuseIPDB) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action: requestlog.ActionDenied,
+		action: requestlog.ActionClientDenied,
 		figures: map[string]any{
 			figureScore: score, "min_score": rq.h.config.AbuseIPDBMinScore,
 		},

internal/discriminator/admin.go

@@ -42,7 +42,7 @@ var (
 
 // answerHealth answers a request for the health endpoint.
 func (rq *request) answerHealth() {
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 	// Set here rather than left to Go's server, which would set it only
 	// after the log line has taken the response's headers.
 	rq.out.Header().Set("Content-Type", "text/plain; charset=utf-8")
@@ -55,7 +55,7 @@ func (rq *request) answerHealth() {
 // refused with 401. An endpoint whose token is unset answers 404, as any other
 // path does.
 func (rq *request) answerAdmin() {
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 
 	token, answer := rq.endpoint()
 

internal/discriminator/admin_test.go

@@ -40,7 +40,7 @@ func TestAdminEndpointsAreOffWhileTheTokenIsUnset(t *testing.T) {
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{adminBearer, bearer, "Bearer ", ""} {
 		for _, e := range adminEndpoints() {
-			s.adminRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
+			s.ownEndpointRequest(authorization, e.method, e.path, e.body, http.StatusNotFound)
 		}
 	}
 
@@ -67,7 +67,7 @@ func TestAdminEndpointsNeedTheAdminToken(t *testing.T) {
 		for _, authorization := range []string{
 			"", bearer, "Bearer " + strings.ToUpper(adminSecret), "Basic " + adminSecret,
 		} {
-			got := s.adminRequest(authorization, e.method, e.path, e.body,
+			got := s.ownEndpointRequest(authorization, e.method, e.path, e.body,
 				http.StatusUnauthorized)
 			if got.header.Get("WWW-Authenticate") != "Bearer" {
 				t.Errorf("%s %s with %q was answered without WWW-Authenticate: Bearer",
@@ -121,7 +121,7 @@ func TestBanAddedListedAndLiftedThroughTheEndpoints(t *testing.T) {
 	wantBans(t, s.admin(http.MethodPost, discriminator.BansPath, banOtherClient,
 		http.StatusOK), want)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	if line.BanExpires != requestlog.FormatTime(expires) {
 		t.Errorf("the ban ends at %s, want %s", line.BanExpires, expires)
 	}
@@ -276,7 +276,7 @@ func TestClientEndpointShowsTheClientAndItsBans(t *testing.T) {
 	// limit of two a minute, and bans it.
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	// Asked about by its address in IPv6 form too.
 	for _, addr := range []string{otherClient, "::ffff:" + otherClient} {
@@ -329,7 +329,7 @@ func TestAdminEndpointsNeedTheTokenInObserveMode(t *testing.T) {
 	})
 
 	for _, e := range adminEndpoints() {
-		s.adminRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
+		s.ownEndpointRequest("", e.method, e.path, e.body, http.StatusUnauthorized)
 	}
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {
@@ -356,16 +356,16 @@ func adminEndpoints() []adminEndpoint {
 
 // admin sends a request with method for path, with body, to discriminator's own
 // address, with the admin token, and checks that it is answered with status, its
-// log line's action admin. It returns the answer.
+// log line's action own_endpoint. It returns the answer.
 func (s *sender) admin(method, path, body string, status int) answer {
 	s.t.Helper()
 
-	return s.adminRequest(adminBearer, method, path, body, status)
+	return s.ownEndpointRequest(adminBearer, method, path, body, status)
 }
 
-// adminRequest is admin with authorization as the request's Authorization header
+// ownEndpointRequest is admin with authorization as the request's Authorization
-// unless it is "".
+// header unless it is "".
-func (s *sender) adminRequest(
+func (s *sender) ownEndpointRequest(
 	authorization, method, path, body string, status int,
 ) answer {
 	s.t.Helper()
@@ -380,7 +380,7 @@ func (s *sender) adminRequest(
 
 	line := s.out.endedLines(s.t, s.sent+1)[s.sent]
 	s.sent++
-	wantLine(s.t, line, status, requestlog.ActionAdmin)
+	wantLine(s.t, line, status, requestlog.ActionOwnEndpoint)
 
 	return got
 }

internal/discriminator/alerts_test.go

@@ -31,14 +31,14 @@ func TestBanForABrokenLimitRaisesABanAlertWithItsNotes(t *testing.T) {
 	start := clk.Now()
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	netblock := netip.MustParsePrefix("203.0.113.0/24")
 	ban := server.Ledger.Bans(netblock)[0]
 
 	// A request refused under the ban raises no other alert.
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	wantAlerts(t, queue, banAlert(alerts.EventBan, start, client, bans.Ban{
 		Netblock: netblock, Cause: bans.CauseLimit,
@@ -62,22 +62,24 @@ func TestAttackBanRaisesABanAlertThenAPermanentBanAlert(t *testing.T) {
 
 	// The probe bans the client for seven days, and its next request makes
 	// the ban permanent. The request after that changes nothing.
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	attackBan := server.Ledger.Bans(netblock)[0]
 
 	clk.advance(time.Minute)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	permanentBan := server.Ledger.Bans(netblock)[0]
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	// Another client's probe after its first ban has run out without a
 	// request makes a permanent ban at once.
-	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 	clk.advance(7 * 24 * time.Hour)
-	s.request(otherClient, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(otherClient, "/.env", http.StatusForbidden,
+		requestlog.ActionPermanentlyBanned)
 
 	otherBans := server.Ledger.Bans(other)
 

internal/discriminator/anomaly_test.go

@@ -73,7 +73,7 @@ func TestEachScopeAndWindowOverItsThresholdAlertsOncePerCooldown(t *testing.T) {
 		{anomalyASN, anomaly.ScopeASN, netip.Prefix{}, asnDE, map[string]any{"asn": asnDE}},
 		{anomalyTotal, anomaly.ScopeTotal, netip.Prefix{}, "the whole service", nil},
 		{
-			anomalyWatch, anomaly.ScopeWatch, netip.MustParsePrefix(clientsNet),
+			anomalyWatch, anomaly.ScopeWatchedNet, netip.MustParsePrefix(clientsNet),
 			"the named netblock office, " + clientsNet, map[string]any{"name": "office"},
 		},
 	} {
@@ -187,7 +187,7 @@ func TestEveryRequestIsCountedWhateverIsDoneWithIt(t *testing.T) {
 		{allowed, "/", http.StatusOK, requestlog.ActionForward},
 		{exempt, "/", http.StatusOK, requestlog.ActionForward},
 		{client, "/static/app.js", http.StatusOK, requestlog.ActionForward},
-		{denied, "/", http.StatusForbidden, requestlog.ActionDenied},
+		{denied, "/", http.StatusForbidden, requestlog.ActionClientDenied},
 	} {
 		for range 3 {
 			s.request(sent.from, sent.path, sent.status, sent.action)

internal/discriminator/answertime_test.go

@@ -36,8 +36,8 @@ const (
 	// tooLarge is how discriminator refuses a request over the header limits.
 	tooLarge = http.StatusRequestHeaderFieldsTooLarge
 	// silentAbuseIPDBURL is where AbuseIPDB never answers: at the stand-in
-	// that unansweredGeoJSURL names too.
+	// that silentGeoJSURL names too.
-	silentAbuseIPDBURL = "unanswered://abuseipdb/api/v2/check"
+	silentAbuseIPDBURL = "silent://abuseipdb/api/v2/check"
 	// wholeLimit is the percentage of a rate limit that lowers it not at all.
 	wholeLimit = 100
 	// clientsDecision is the CrowdSec decision list holding client alone.
@@ -84,10 +84,10 @@ func TestSixteenThousandCookiesAreRefusedWellWithinTheTimeLimit(t *testing.T) {
 	wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
-	if line.DurationWAF != nil {
+	if line.DurationCoreRuleSetMS != nil {
-		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationWAF)
+		t.Errorf("the Core Rule Set read the request, for %f ms", *line.DurationCoreRuleSetMS)
 	}
 }
 
@@ -157,7 +157,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 
 			if tc.refused {
 				wantDisposition(t, got, tooLarge, discriminator.DispositionDeny)
-				wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+				wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
 				return
 			}
@@ -165,7 +165,7 @@ func TestEachHeaderLimitRefusesARequestOverIt(t *testing.T) {
 			wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 
-			if line.DurationWAF == nil {
+			if line.DurationCoreRuleSetMS == nil {
 				t.Error("the Core Rule Set did not read a request within the limits")
 			}
 		})
@@ -219,9 +219,10 @@ func TestObserveModeAllowsARequestOverTheHeaderLimitsUnread(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, discriminator.DispositionAllow)
 
 	line := s.out.requestLine(t)
-	if line.WouldAction != requestlog.ActionTooLarge || line.DurationWAF != nil {
+	if line.WouldAction != requestlog.ActionRequestHeaderTooLarge ||
-		t.Errorf("would_action %q and duration_waf %v, want %q and none",
+		line.DurationCoreRuleSetMS != nil {
-			line.WouldAction, line.DurationWAF, requestlog.ActionTooLarge)
+		t.Errorf("would_action %q and duration_core_rule_set_ms %v, want %q and none",
+			line.WouldAction, line.DurationCoreRuleSetMS, requestlog.ActionRequestHeaderTooLarge)
 	}
 }
 
@@ -240,7 +241,7 @@ func TestRequestsOverTheHeaderLimitsCountTowardTheRateLimits(t *testing.T) {
 	wantDisposition(t, ask(), http.StatusForbidden, discriminator.DispositionDeny)
 
 	lines := s.out.requestLines(t, 2)
-	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionRateLimited)
+	wantLine(t, lines[1], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 }
 
 func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
@@ -249,8 +250,8 @@ func TestTheHeaderLimitsComeAfterTheTrapPathsAndTheRuleFiles(t *testing.T) {
 	for _, tc := range []struct {
 		name, path, action string
 	}{
-		{"a trap path", "/wp-login.php", requestlog.ActionBanned},
+		{"a trap path", "/wp-login.php", requestlog.ActionTemporarilyBanned},
-		{"a block rule", "/blocked", requestlog.ActionRuleBlocked},
+		{"a block rule", "/blocked", requestlog.ActionBlockedByBlockRule},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -280,10 +281,10 @@ func TestNotWaitingForGeoJSNeverLowersAClientsLimit(t *testing.T) {
 	wantDisposition(t, do(t, req), tooLarge, discriminator.DispositionDeny)
 
 	line := s.out.requestLine(t)
-	wantLine(t, line, tooLarge, requestlog.ActionTooLarge)
+	wantLine(t, line, tooLarge, requestlog.ActionRequestHeaderTooLarge)
 
-	if line.LimitPercent != nil {
+	if line.RateLimitPercent != nil {
-		t.Errorf("limit percentage %d, want none", *line.LimitPercent)
+		t.Errorf("limit percentage %d, want none", *line.RateLimitPercent)
 	}
 
 	// The client is under no ban, and GeoJS places it in a country.
@@ -304,7 +305,8 @@ func TestAClientGeoJSPlacedInNoCountryCountsAsUnknownWithoutWaiting(t *testing.T
 	req.Header.Set(cookieHeader, cookies(cookieLimit+1))
 
 	wantDisposition(t, do(t, req), http.StatusForbidden, discriminator.DispositionDeny)
-	wantLine(t, s.out.requestLine(t), http.StatusForbidden, requestlog.ActionRateLimited)
+	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited)
 }
 
 func TestObserveModeWaitsForGeoJSForARequestOverTheHeaderLimits(t *testing.T) {
@@ -338,7 +340,7 @@ func newDiscriminatorInBubble(
 	settings := map[string]string{tagDeny: "country=KP"}
 	maps.Copy(settings, env)
 
-	server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now, settings)
+	server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now, settings)
 
 	return server, out
 }
@@ -412,33 +414,37 @@ func TestARefusedRequestDoesNotWaitForASlowGeoJS(t *testing.T) {
 	}{
 		{
 			name: "SWW_DENY_NETS", env: map[string]string{denyNets: client},
-			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionDenied,
+			prepare: leaveAsItIs, status: forbidden, action: requestlog.ActionClientDenied,
 		},
 		{
 			name:    "a ban",
-			prepare: banClient, status: forbidden, action: requestlog.ActionBanned,
+			prepare: banClient, status: forbidden, action: requestlog.ActionTemporarilyBanned,
 		},
 		{
 			name: "the rate limits", env: map[string]string{rateLimitPerMinute: "1"},
-			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
 		},
 		{
 			name:    "the rate limits, with a biased threshold",
 			env:     map[string]string{rateLimitPerMinute: "1", unknownLimitPercent: "50"},
-			prepare: countClient, status: forbidden, action: requestlog.ActionRateLimited,
+			prepare: countClient, status: forbidden,
+			action: requestlog.ActionClientIsRateLimited,
 		},
 		{
 			name: "a blocklist", env: map[string]string{blocklistURLs: dropURL},
-			prepare: listClient, status: forbidden, action: requestlog.ActionDenied,
+			prepare: listClient, status: forbidden, action: requestlog.ActionClientDenied,
 		},
 		{
 			name:    "the CrowdSec decision list",
 			env:     map[string]string{crowdSecURL: lapi, crowdSecKey: bouncerKey},
-			prepare: decideOnClient, status: forbidden, action: requestlog.ActionBanned,
+			prepare: decideOnClient, status: forbidden,
+			action: requestlog.ActionTemporarilyBanned,
 		},
 		{
 			name: "the header limits", cookie: cookies(cookieLimit + 1),
-			prepare: leaveAsItIs, status: tooLarge, action: requestlog.ActionTooLarge,
+			prepare: leaveAsItIs, status: tooLarge,
+			action: requestlog.ActionRequestHeaderTooLarge,
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {

internal/discriminator/bans.go

@@ -50,13 +50,23 @@ func (activeBan) check(_ context.Context, rq *request, now time.Time) *verdict {
 	}
 
 	return &verdict{
-		action: requestlog.ActionBanned,
+		action: banAction(ban.Permanent()),
 		figures: map[string]any{
 			figureNetblock: ban.Netblock.String(), "ban_expires": rq.line.BanExpires,
 		},
 	}
 }
 
+// banAction is the action of a request refused under a ban or for making one:
+// permanent says the ban never runs out.
+func banAction(permanent bool) string {
+	if permanent {
+		return requestlog.ActionPermanentlyBanned
+	}
+
+	return requestlog.ActionTemporarilyBanned
+}
+
 // limitFigures are the figures of a heuristic that broke hit, a limit: its
 // window, the count and the limit.
 func limitFigures(hit ratelimit.Hit) map[string]any {
@@ -96,7 +106,7 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 	case ratelimit.KindBytes:
 		rq.line.LimitHit = hit.Window + "_bytes" // as counts names the byte totals
 	case ratelimit.KindRefusals:
-		rq.line.LimitHit = requestlog.LimitHitErrorBurst
+		rq.line.LimitHit = requestlog.LimitHitMinuteRefusals
 	default:
 		rq.line.LimitHit = hit.Window
 	}
@@ -124,9 +134,9 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 
 	switch hit.Kind {
 	case ratelimit.KindRequests:
-		notes.LimitPercent, notes.LimitPercentSetting = rq.limitPercent.logged()
+		notes.LimitPercent, notes.LimitPercentSetting = rq.rateLimitPercent.logged()
 	case ratelimit.KindBytes:
-		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesPercent.logged()
+		notes.LimitPercent, notes.LimitPercentSetting = rq.bytesLimitPercent.logged()
 	}
 
 	if rq.h.config.Observe {
@@ -151,11 +161,11 @@ func (rq *request) banForLimit(now time.Time, hit ratelimit.Hit, status int) {
 // attack, which notes name: the ban rule that matched, or the trap path
 // asked for. It fills in the rest of the notes. In observe mode it makes
 // no ban, and raises the alert for the ban it would have made, if that
-// alert would be sent.
+// alert would be sent. It returns the action for that ban.
-func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
+func (rq *request) banForAttack(now time.Time, notes bans.Notes) string {
 	netblock := rq.h.netblock(rq.client)
 	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseAttack) {
-		return
+		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseAttack))
 	}
 
 	notes.ASN = rq.line.ASN
@@ -171,7 +181,7 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
 			rq.alertBan(ban)
 		}
 
-		return
+		return banAction(ban.Permanent())
 	}
 
 	ban, made := rq.h.ledger.BanForAttack(netblock, now, notes)
@@ -180,16 +190,18 @@ func (rq *request) banForAttack(now time.Time, notes bans.Notes) {
 	if made {
 		rq.alertBan(ban)
 	}
+
+	return banAction(ban.Permanent())
 }
 
 // banForCrowdSec bans the client's netblock at now until decision,
 // CrowdSec's decision on the client, ends. In observe mode it makes no
 // ban, and raises the alert for the ban it would have made, if that alert
-// would be sent.
+// would be sent. It returns the action for that ban.
-func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
+func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) string {
 	netblock := rq.h.netblock(rq.client)
 	if rq.h.config.Observe && !rq.wouldAlertBan(netblock, now, bans.CauseCrowdSec) {
-		return
+		return banAction(rq.h.ledger.WouldBePermanent(netblock, now, bans.CauseCrowdSec))
 	}
 
 	notes := bans.Notes{
@@ -208,7 +220,7 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
 			rq.alertBan(ban)
 		}
 
-		return
+		return banAction(ban.Permanent())
 	}
 
 	ban, made := rq.h.ledger.BanForCrowdSec(netblock, now, decision.Expires,
@@ -218,6 +230,8 @@ func (rq *request) banForCrowdSec(now time.Time, decision reputation.Decision) {
 	if made {
 		rq.alertBan(ban)
 	}
+
+	return banAction(ban.Permanent())
 }
 
 // wouldAlertBan reports whether the alert for a ban on netblock for cause

internal/discriminator/bans_test.go

@@ -40,7 +40,7 @@ func TestBrokenLimitBansTheClient(t *testing.T) {
 	// client for an hour, the default.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 		line.BanExpires != expires {
 		t.Errorf("log line has limit_hit %q, offence %q and ban_expires %q, "+
@@ -51,7 +51,7 @@ func TestBrokenLimitBansTheClient(t *testing.T) {
 	// Every request while the ban lasts is refused.
 	clk.advance(time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	if line.BanExpires != expires || line.Offence != "" || line.LimitHit != "" {
 		t.Errorf("log line has ban_expires %q, offence %q and limit_hit %q, "+
 			"want %s and neither of the others", line.BanExpires, line.Offence,
@@ -78,7 +78,9 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	breakLimit := func() string {
 		s.get(client, http.StatusOK, requestlog.ActionForward)
 
-		return s.get(client, http.StatusForbidden, requestlog.ActionRateLimited).BanExpires
+		line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+
+		return line.BanExpires
 	}
 	wantExpires := func(got string, length time.Duration) {
 		t.Helper()
@@ -111,7 +113,7 @@ func TestBanLengthsFollowTheSettings(t *testing.T) {
 	}
 
 	clk.advance(365 * 24 * time.Hour)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 }
 
 func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
@@ -123,10 +125,10 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	// client for an hour.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	for range 3 {
-		s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+		s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	}
 
 	// Later the same day the client has its whole allowance again: the
@@ -135,7 +137,7 @@ func TestBanIsNotCountedAndResetsTheCounters(t *testing.T) {
 	clk.advance(time.Hour)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	banned := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
 	if len(banned) != 2 || banned[0].Notes.Refused != 3 {
@@ -190,10 +192,10 @@ func TestBanCoversTheClientsNetblock(t *testing.T) {
 			s, _, _ := startWithClock(t, "", env)
 
 			s.get(tc.breaker, http.StatusOK, requestlog.ActionForward)
-			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionRateLimited)
+			s.get(tc.breaker, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 			for _, sent := range tc.refused {
-				s.get(sent, http.StatusForbidden, requestlog.ActionBanned)
+				s.get(sent, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 			}
 
 			for _, sent := range tc.let {
@@ -216,9 +218,9 @@ func TestBannedClientIsRefusedBeforeItsCountryIsLookedUp(t *testing.T) {
 
 	// fromDE's ban covers otherClient, which is refused unasked about.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	if line.Country != "" {
 		t.Errorf("log line has country %q, want none", line.Country)
 	}
@@ -237,9 +239,9 @@ func TestRefusalUnderABanNamesItsHeuristicNetblockAndEnd(t *testing.T) {
 	expires := requestlog.FormatTime(clk.Now().Add(time.Hour))
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantHeuristic(t, line, "active_ban",
 		`{"netblock": "`+clientsNet+`", "ban_expires": "`+expires+`"}`)
 }
@@ -275,11 +277,11 @@ func TestBanResponseAnswersEveryRefusalButTheSizeLimits(t *testing.T) {
 
 			s, _, _ := startWithClock(t, geojsURL, env)
 
-			s.get(denied, tc.status, requestlog.ActionDenied)
+			s.get(denied, tc.status, requestlog.ActionClientDenied)
-			s.get(fromKP, tc.status, requestlog.ActionDenied)
+			s.get(fromKP, tc.status, requestlog.ActionClientDenied)
 			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-			s.get(fromDE, tc.status, requestlog.ActionRateLimited)
+			s.get(fromDE, tc.status, requestlog.ActionClientIsRateLimited)
-			s.get(fromDE, tc.status, requestlog.ActionBanned)
+			s.get(fromDE, tc.status, requestlog.ActionTemporarilyBanned)
 		})
 	}
 }
@@ -297,9 +299,9 @@ func TestBanNotes(t *testing.T) {
 
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	s.request(fromDE, "/repo/commits?page=2",
-		http.StatusForbidden, requestlog.ActionRateLimited)
+		http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	netblock := netip.MustParsePrefix(fromDE + "/32")
 	want := bans.Ban{
@@ -342,7 +344,7 @@ func TestBanNotes(t *testing.T) {
 	// The next ban counts this one among the earlier.
 	clk.advance(time.Hour)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	got = ledger.Bans(netblock)
 	if len(got) != 2 || got[1].Notes.EarlierBans != (bans.EarlierBans{Limit: 1}) {
@@ -360,12 +362,12 @@ func TestMaxBansDropsTheBanOfTheNetblockSeenLongestAgo(t *testing.T) {
 
 	// One ban is held, so otherClient's ban drops client's.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(otherClient, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(otherClient, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 // clock is the time a test sets, by which sww counts requests and
@@ -413,7 +415,7 @@ func startWithClock(
 
 // sender sends requests to rproxy one after another, each on a connection of its
 // own, and checks each one's answer and log line. discriminatorAddr is where
-// discriminator's own endpoints are, which adminRequest asks. Every request
+// discriminator's own endpoints are, which ownEndpointRequest asks. Every request
 // discriminator gets must come through the sender, since the log lines are
 // matched to them in order.
 type sender struct {

internal/discriminator/biased_test.go

@@ -76,17 +76,19 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 			}{
 				{http.StatusOK, requestlog.ActionForward},
 				{http.StatusOK, requestlog.ActionForward},
-				{http.StatusForbidden, requestlog.ActionRateLimited},
+				{http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 			} {
 				line := s.get(tc.from, sent.status, sent.action)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					"50 from "+tc.setting)
 			}
 
 			// fromKP, which no setting lists, has the whole limit.
 			for range 3 {
 				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
 			}
 		})
@@ -119,7 +121,8 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
 			}
 
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
 				"50 from "+tc.setting)
 
 			// fromKP, which no setting lists, has the whole limit.
@@ -128,7 +131,8 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
 			}
 
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting, none)
 		})
 	}
 }
@@ -139,9 +143,9 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
-		// limitPercent and bytesPercent are the log line's, as percentText
+		// rateLimitPercent and bytesLimitPercent are the log line's, as
-		// gives them, and limitHit is its limit_hit.
+		// percentText gives them, and limitHit is its limit_hit.
-		limitPercent, bytesPercent, limitHit string
+		rateLimitPercent, bytesLimitPercent, limitHit string
 	}{
 		{
 			"lowering the byte limits alone",
@@ -177,10 +181,12 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
 			}
 
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
-				tc.limitPercent)
+				line.RateLimitPercent, line.RateLimitPercentSetting,
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				tc.rateLimitPercent)
-				tc.bytesPercent)
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
+				tc.bytesLimitPercent)
 		})
 	}
 }
@@ -192,15 +198,15 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 
 	// The first request breaks the limit, and bans the client; the log line
 	// gives the 0.
-	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	if line.fields["limit_percent"] != float64(0) ||
+	if line.fields["rate_limit_percent"] != float64(0) ||
-		line.fields["limit_percent_setting"] != unknownLimitPercent {
+		line.fields["rate_limit_percent_setting"] != unknownLimitPercent {
-		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
+		t.Errorf("log line has rate_limit_percent %v from %v, want 0 from %s",
-			line.fields["limit_percent"], line.fields["limit_percent_setting"],
+			line.fields["rate_limit_percent"], line.fields["rate_limit_percent_setting"],
 			unknownLimitPercent)
 	}
 
-	s.get(unplaced, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(unplaced, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestLowestPercentageApplies(t *testing.T) {
@@ -210,7 +216,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 		name string
 		env  map[string]string
 		from string
-		// want is the log line's limit_percent, as percentText gives it.
+		// want is the log line's rate_limit_percent, as percentText gives it.
 		want string
 	}{
 		{
@@ -250,8 +256,9 @@ func TestLowestPercentageApplies(t *testing.T) {
 			// A quarter of 4 requests a minute: the second breaks the limit.
 			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
 
-			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionRateLimited)
+			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
+				line.RateLimitPercent, line.RateLimitPercentSetting,
 				tc.want)
 		})
 	}
@@ -269,7 +276,7 @@ func TestUnknownLimitPercentGivesEveryClientWithoutACountryItsPercentage(t *test
 	for _, from := range []string{unplaced, "10.0.0.8"} {
 		s.get(from, http.StatusOK, requestlog.ActionForward)
 		s.get(from, http.StatusOK, requestlog.ActionForward)
-		s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+		s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	}
 
 	// One in a country has the whole limit.
@@ -284,7 +291,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
 			map[string]string{unknownLimitPercent: "0"})
 
 		// Once the time the request waits for its answer is up, the client
@@ -293,8 +300,9 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 		serveFromDE(t, server, http.MethodGet, http.NoBody)
 
 		line := out.requestLine(t)
-		wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+		wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+		wantPercent(t, "rate_limit_percent",
+			line.RateLimitPercent, line.RateLimitPercentSetting,
 			"0 from "+unknownLimitPercent)
 	})
 }
@@ -327,7 +335,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
+				server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
 					map[string]string{
 						lookupTimeout: timeout.String(), tagLists: "vpn=" + vpnList, tc.setting: tc.value,
 					})
@@ -374,7 +382,7 @@ func TestBanForALoweredLimitGivesThePercentageInItsNotesAndItsAlert(t *testing.T
 			// A quarter of 12 requests a minute is 3: the fourth breaks it.
 			"a rate limit",
 			map[string]string{rateLimitPerMinute: "12", tagLimitPercent: asnTagDEQuarter},
-			3, http.StatusForbidden, requestlog.ActionRateLimited,
+			3, http.StatusForbidden, requestlog.ActionClientIsRateLimited,
 			"requests per minute over the limit of 3", "25 from " + tagLimitPercent,
 		},
 		{

internal/discriminator/blocklists.go

@@ -28,7 +28,7 @@ func (blocklists) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action:  requestlog.ActionDenied,
+		action:  requestlog.ActionClientDenied,
 		figures: map[string]any{"lists": listedBy},
 	}
 }

internal/discriminator/bytelimits.go

@@ -6,8 +6,6 @@ package discriminator
 import (
 	"context"
 	"time"
-
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
 
 // byteLimits counts the request's bytes, as countedBytes gives them, for the
@@ -28,7 +26,7 @@ func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 	}
 
 	counts, hit, over := rq.h.limiter.CountBytes(rq.h.clientGroup(rq.client), now,
-		rq.countedBytes(), rq.bytesPercent.percent)
+		rq.countedBytes(), rq.bytesLimitPercent.percent)
 	rq.line.Counts.MinuteBytes = counts.MinuteBytes
 	rq.line.Counts.HourBytes = counts.HourBytes
 	rq.line.Counts.DayBytes = counts.DayBytes
@@ -39,5 +37,5 @@ func (byteLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 
 	rq.banForLimit(now, hit, rq.out.status)
 
-	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
+	return &verdict{figures: limitFigures(hit)}
 }

internal/discriminator/bytelimits_test.go

@@ -90,7 +90,7 @@ func TestEachByteLimitBansOnceTheResponseHasEnded(t *testing.T) {
 					line.BanExpires, tc.window, expires)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 			wantMetric(t, s.scrape(), `sww_rate_limit_hits_total{`+
 				`instance="`+alertInstance+`",kind="bytes",window="`+tc.window+`"}`, 1)
@@ -125,7 +125,7 @@ func TestResponseOverAByteLimitByItselfIsPassedOnWhole(t *testing.T) {
 			len(got.body), got.err, line.LimitHit, answerBytes, minuteBytes)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
@@ -147,7 +147,7 @@ func TestBytesOfAnAnswerThatBreaksOffAreCounted(t *testing.T) {
 			answerBytes, minuteBytes, expires)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
@@ -176,7 +176,7 @@ func TestWebSocketBytesAreCountedOnceItCloses(t *testing.T) {
 					line.LimitHit, line.Counts.MinuteBytes, minuteBytes, tc.counted)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 		})
 	}
 }
@@ -218,7 +218,7 @@ func TestBytesCountSaysWhichBytesCount(t *testing.T) {
 				}
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 		})
 	}
 }
@@ -386,7 +386,7 @@ func TestObserveModeLeavesOutTheBytesOfARequestEnforceModeRefuses(t *testing.T)
 	// counted, and the byte limit is not broken. Its line gives the bytes
 	// counted before it.
 	line := s.upload()
-	wantWouldAction(t, line, requestlog.ActionRateLimited)
+	wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
 
 	if line.LimitHit != minute || line.Counts.MinuteBytes != bodyBytes+answerBytes {
 		t.Errorf("log line has limit_hit %q and minute_bytes %v, want minute and %d",

internal/discriminator/coreruleset.go

@@ -9,8 +9,8 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
-	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // coreRuleSet inspects the request with the Core Rule Set, unless
@@ -18,7 +18,7 @@ import (
 // pathExempt decides, and notes the rules it matched and its score in the
 // log line, and the rules in the metrics. A score at or over
 // SWW_WAF_ANOMALY_THRESHOLD is a match: it adds the tag exploitsignature,
-// raises the waf_block alert, and in block mode refuses the request with 403,
+// raises the core_rule_set_match alert, and in block mode refuses the request with 403,
 // which is an offence its client's history counts. Its figures are the score
 // and the threshold.
 type coreRuleSet struct{}
@@ -38,12 +38,12 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	result, read, _ := rq.h.coreRuleSet.Inspect(rq.in, rq.client, rq.in.Body)
 	rq.requestBytes = int64(len(read))
 
-	rq.line.DurationWAF = new(requestlog.Milliseconds(time.Since(start)))
+	rq.line.DurationCoreRuleSetMS = new(requestlog.Milliseconds(time.Since(start)))
-	rq.line.WAFRuleIDs = result.RuleIDs
+	rq.line.CoreRuleSetRuleIDs = result.RuleIDs
-	rq.line.WAFScore = &result.Score
+	rq.line.CoreRuleSetScore = &result.Score
 
 	for _, id := range result.RuleIDs {
-		rq.h.metrics.WAFMatched(cfg.WAFMode, id)
+		rq.h.metrics.CoreRuleSetMatched(cfg.WAFMode, id)
 	}
 
 	threshold := cfg.WAFAnomalyThreshold
@@ -52,26 +52,26 @@ func (coreRuleSet) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	rq.addTag(config.ExploitSignatureTag)
-	rq.alertWAFBlock(result)
+	rq.alertCoreRuleSetMatch(result)
 
 	if cfg.WAFMode == config.WAFModeDetect {
 		return nil
 	}
 
-	rq.wafBlocked = true
+	rq.blockedByCoreRuleSet = true
 
 	return &verdict{
-		action:  requestlog.ActionWAFBlocked,
+		action:  requestlog.ActionBlockedByCoreRuleSet,
 		figures: map[string]any{figureScore: result.Score, "threshold": threshold},
 	}
 }
 
-// alertWAFBlock raises the waf_block alert for the request, which the Core
+// alertCoreRuleSetMatch raises the core_rule_set_match alert for the request,
-// Rule Set scored at result, at or over SWW_WAF_ANOMALY_THRESHOLD. Its
+// which the Core Rule Set scored at result, at or over SWW_WAF_ANOMALY_THRESHOLD. Its
 // detail gives the rule ids, the score, the method and the path with the
 // query, and, for a request that is not refused for it, the mode: detect,
 // or observe in observe mode.
-func (rq *request) alertWAFBlock(result waf.Result) {
+func (rq *request) alertCoreRuleSetMatch(result coreruleset.Result) {
 	detail := map[string]any{
 		"rule_ids": result.RuleIDs,
 		"score":    result.Score,
@@ -87,7 +87,7 @@ func (rq *request) alertWAFBlock(result waf.Result) {
 	}
 
 	rq.h.alerts.Raise(alerts.Alert{
-		Event:    alerts.EventWAFBlock,
+		Event:    alerts.EventCoreRuleSetMatch,
 		Host:     rq.site,
 		Client:   rq.client,
 		Netblock: rq.h.clientGroup(rq.client),

internal/discriminator/coreruleset_test.go

@@ -40,24 +40,30 @@ const (
 // SWW_WAF_ANOMALY_THRESHOLD.
 const sqlInjection = "/?id=1'%20OR%20'1'='1"
 
-// wantWAF checks the request log line's waf_rule_ids and waf_score, and
+// wantCoreRuleSet checks the request log line's core_rule_set_rule_ids and
-// that it has duration_waf, or with no score, that it has none of the
+// core_rule_set_score, and that it has duration_core_rule_set_ms, or with no
-// three: the Core Rule Set did not inspect the request.
+// score, that it has none of the three: the Core Rule Set did not inspect the
-func wantWAF(t *testing.T, line logLine, score *int, ruleIDs ...int) {
+// request.
+func wantCoreRuleSet(t *testing.T, line logLine, score *int, ruleIDs ...int) {
 	t.Helper()
 
-	if !slices.Equal(line.WAFRuleIDs, ruleIDs) {
+	if !slices.Equal(line.CoreRuleSetRuleIDs, ruleIDs) {
-		t.Errorf("log line has waf_rule_ids %v, want %v", line.WAFRuleIDs, ruleIDs)
+		t.Errorf("log line has core_rule_set_rule_ids %v, want %v",
+			line.CoreRuleSetRuleIDs, ruleIDs)
 	}
 
 	switch {
-	case score == nil && (line.WAFScore != nil || line.DurationWAF != nil):
+	case score == nil &&
-		t.Errorf("log line has waf_score %v and duration_waf %v, want neither",
+		(line.CoreRuleSetScore != nil || line.DurationCoreRuleSetMS != nil):
-			line.fields["waf_score"], line.fields["duration_waf"])
+		t.Errorf("log line has core_rule_set_score %v and "+
-	case score != nil && (line.WAFScore == nil || *line.WAFScore != *score):
+			"duration_core_rule_set_ms %v, want neither",
-		t.Errorf("log line has waf_score %v, want %d", line.fields["waf_score"], *score)
+			line.fields["core_rule_set_score"], line.fields["duration_core_rule_set_ms"])
-	case score != nil && line.DurationWAF == nil:
+	case score != nil &&
-		t.Error("log line has no duration_waf")
+		(line.CoreRuleSetScore == nil || *line.CoreRuleSetScore != *score):
+		t.Errorf("log line has core_rule_set_score %v, want %d",
+			line.fields["core_rule_set_score"], *score)
+	case score != nil && line.DurationCoreRuleSetMS == nil:
+		t.Error("log line has no duration_core_rule_set_ms")
 	}
 }
 
@@ -70,7 +76,7 @@ func TestCoreRuleSetMatchAddsTheExploitSignatureTag(t *testing.T) {
 		status int
 		action string
 	}{
-		{block, block, http.StatusForbidden, requestlog.ActionWAFBlocked},
+		{block, block, http.StatusForbidden, requestlog.ActionBlockedByCoreRuleSet},
 		{detect, detect, http.StatusOK, requestlog.ActionForward},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -92,7 +98,8 @@ func TestDetectedAttackIsRefusedByTagDenyLast(t *testing.T) {
 		wafMode: detect, tagDeny: "exploitsignature",
 	})
 
-	line := s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 }
 
@@ -132,14 +139,14 @@ func TestCoreRuleSetRefusesAttacksInBlockModeAndOnlyLogsThemInDetectMode(t *test
 				mode, action string
 				status       int
 			}{
-				{block, requestlog.ActionWAFBlocked, http.StatusForbidden},
+				{block, requestlog.ActionBlockedByCoreRuleSet, http.StatusForbidden},
 				{detect, requestlog.ActionForward, http.StatusOK},
 			} {
 				s, _, _ := startWithClock(t, "", map[string]string{wafMode: tc.mode})
 
 				line := s.requestWithHeader(client, attack.path, attack.header,
 					tc.status, tc.action)
-				wantWAF(t, line, &attack.score, attack.ruleIDs...)
+				wantCoreRuleSet(t, line, &attack.score, attack.ruleIDs...)
 			}
 		})
 	}
@@ -151,7 +158,7 @@ func TestCoreRuleSetRefusalNamesItsHeuristicScoreAndThreshold(t *testing.T) {
 	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 
 	line := s.request(client, sqlInjection, http.StatusForbidden,
-		requestlog.ActionWAFBlocked)
+		requestlog.ActionBlockedByCoreRuleSet)
 	wantHeuristic(t, line, "core_rule_set", `{"score": 5, "threshold": 5}`)
 }
 
@@ -162,7 +169,7 @@ func TestOrdinaryRequestIsInspectedAndPassed(t *testing.T) {
 
 	line := s.request(client, "/owner/repo/src/branch/main/README.md?display=source",
 		http.StatusOK, requestlog.ActionForward)
-	wantWAF(t, line, new(0))
+	wantCoreRuleSet(t, line, new(0))
 }
 
 func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
@@ -182,26 +189,26 @@ func TestCoreRuleSetIsNotRunWhenOffOrForAnExemptClientPathOrRuleFileRefusal(
 	// A client in SWW_ALLOW_NETS, and a path SWW_WAF_EXEMPT_PATHS
 	// exempts, are not inspected.
 	line := s.request(allowed, sqlInjection, http.StatusOK, requestlog.ActionForward)
-	wantWAF(t, line, nil)
+	wantCoreRuleSet(t, line, nil)
 	line = s.request(client, "/api/v1/repos?id=1'%20OR%20'1'='1", http.StatusOK,
 		requestlog.ActionForward)
-	wantWAF(t, line, nil)
+	wantCoreRuleSet(t, line, nil)
 
 	// The prefix is matched as rate limit exempt paths are: a path that
 	// goes up and out of it is inspected.
 	line = s.request(client, "/api/../?id=1'%20OR%20'1'='1", http.StatusForbidden,
-		requestlog.ActionWAFBlocked)
+		requestlog.ActionBlockedByCoreRuleSet)
-	wantWAF(t, line, new(25), 930100, 930110, 942100)
+	wantCoreRuleSet(t, line, new(25), 930100, 930110, 942100)
 
 	// A request a rule file refuses is not inspected.
 	line = s.request(otherClient, "/blocked?id=1'%20OR%20'1'='1", http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
-	wantWAF(t, line, nil)
+	wantCoreRuleSet(t, line, nil)
 
 	// With SWW_WAF_MODE off, no request is.
 	s, _, _ = startWithClock(t, "", map[string]string{wafMode: off})
 	line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
-	wantWAF(t, line, nil)
+	wantCoreRuleSet(t, line, nil)
 }
 
 func TestAnomalyThreshold(t *testing.T) {
@@ -215,13 +222,14 @@ func TestAnomalyThreshold(t *testing.T) {
 		})
 
 		line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
-		wantWAF(t, line, new(5), 942100)
+		wantCoreRuleSet(t, line, new(5), 942100)
 	}
 
 	s, _, _ := startWithClock(t, "", map[string]string{
 		wafMode: block, wafAnomalyThreshold: "5",
 	})
-	s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+	s.request(client, sqlInjection, http.StatusForbidden,
+		requestlog.ActionBlockedByCoreRuleSet)
 }
 
 func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
@@ -264,7 +272,7 @@ func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 			s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 			line, _ := s.requestWithBody(request.method, client, request.path,
 				request.header, body, http.StatusOK, requestlog.ActionForward)
-			wantWAF(t, line, new(0))
+			wantCoreRuleSet(t, line, new(0))
 
 			// A list given replaces the default.
 			s, _, _ = startWithClock(t, "", map[string]string{
@@ -272,12 +280,12 @@ func TestDisabledRulesSwitchOffWhatGiteaWouldBeRefused(t *testing.T) {
 			})
 			score := 5 * len(request.ruleIDs)
 			line, _ = s.requestWithBody(request.method, client, request.path,
-				request.header, body, http.StatusForbidden, requestlog.ActionWAFBlocked)
+				request.header, body, http.StatusForbidden, requestlog.ActionBlockedByCoreRuleSet)
-			wantWAF(t, line, &score, request.ruleIDs...)
+			wantCoreRuleSet(t, line, &score, request.ruleIDs...)
 
 			// And switches off the rules it lists.
 			line = s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
-			wantWAF(t, line, new(0))
+			wantCoreRuleSet(t, line, new(0))
 		})
 	}
 }
@@ -293,14 +301,14 @@ func TestAttackInAFormBodyIsRefusedOnlyWhileBodiesAreRead(t *testing.T) {
 	s, _, _ := startWithClock(t, "", map[string]string{wafMode: block})
 	line, _ := s.requestWithBody(http.MethodPost, client, "/", header, body,
 		http.StatusOK, requestlog.ActionForward)
-	wantWAF(t, line, new(0))
+	wantCoreRuleSet(t, line, new(0))
 
 	s, _, _ = startWithClock(t, "", map[string]string{
 		wafMode: block, wafBodyLimit: sizeLimitSetting,
 	})
 	line, _ = s.requestWithBody(http.MethodPost, client, "/", header, body,
-		http.StatusForbidden, requestlog.ActionWAFBlocked)
+		http.StatusForbidden, requestlog.ActionBlockedByCoreRuleSet)
-	wantWAF(t, line, new(5), 942100)
+	wantCoreRuleSet(t, line, new(5), 942100)
 }
 
 func TestBodiesReachTheAppAsSentWhileBodiesAreRead(t *testing.T) {
@@ -390,32 +398,33 @@ func TestCoreRuleSetRefusalIsAnOffenceAndCountsTowardTheErrorBurst(t *testing.T)
 	})
 
 	for range 2 {
-		s.request(client, sqlInjection, http.StatusForbidden, requestlog.ActionWAFBlocked)
+		s.request(client, sqlInjection, http.StatusForbidden,
+			requestlog.ActionBlockedByCoreRuleSet)
 	}
 
 	// The third refusal in a minute breaks the error burst, and bans the
 	// client.
 	line := s.request(client, sqlInjection, http.StatusForbidden,
-		requestlog.ActionWAFBlocked)
+		requestlog.ActionBlockedByCoreRuleSet)
-	if line.LimitHit != requestlog.LimitHitErrorBurst ||
+	if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
 		line.Offence != requestlog.OffenceLimit {
-		t.Errorf("log line has limit_hit %q and offence %q, want error_burst and limit",
+		t.Errorf("log line has limit_hit %q and offence %q, want minute_refusals and limit",
 			line.LimitHit, line.Offence)
 	}
 
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
-	want := ratelimit.Offences{Limit: 1, WAFBlocked: 3}
+	want := ratelimit.Offences{Limit: 1, BlockedByCoreRuleSet: 3}
 	if offences := historyOf(t, server, client).Offences; offences != want {
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`sww_waf_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
+		`sww_core_rule_set_matches_total{instance="app",mode="block",rule_id="942100"}`, 3)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="waf_blocked"}`, 3)
+		`sww_offences_total{instance="app",kind="blocked_by_core_rule_set"}`, 3)
-	wantMetric(t, metrics, `sww_requests_total{action="waf_blocked",`+
+	wantMetric(t, metrics, `sww_requests_total{action="blocked_by_core_rule_set",`+
 		`instance="app",status_class="4xx"}`, 3)
 }
 
@@ -439,9 +448,9 @@ func TestDetectModeMatchIsNoOffenceAndNotCountedTowardTheErrorBurst(t *testing.T
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`sww_waf_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
+		`sww_core_rule_set_matches_total{instance="app",mode="detect",rule_id="942100"}`, 3)
 	wantNoSeries(t, metrics,
-		`sww_offences_total{instance="app",kind="waf_blocked"}`)
+		`sww_offences_total{instance="app",kind="blocked_by_core_rule_set"}`)
 }
 
 func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
@@ -450,17 +459,17 @@ func TestObserveModeLogsWhatTheCoreRuleSetWouldDo(t *testing.T) {
 	s, _, server := startWithClock(t, "", map[string]string{wafMode: block, mode: observe})
 
 	line := s.request(client, sqlInjection, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionWAFBlocked)
+	wantWouldAction(t, line, requestlog.ActionBlockedByCoreRuleSet)
-	wantWAF(t, line, new(5), 942100)
+	wantCoreRuleSet(t, line, new(5), 942100)
 
 	// It is an offence as in enforce mode.
-	want := ratelimit.Offences{WAFBlocked: 1}
+	want := ratelimit.Offences{BlockedByCoreRuleSet: 1}
 	if offences := historyOf(t, server, client).Offences; offences != want {
 		t.Errorf("history counts the offences %+v, want %+v", offences, want)
 	}
 }
 
-func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
+func TestCoreRuleSetMatchRaisesTheCoreRuleSetMatchAlert(t *testing.T) {
 	t.Parallel()
 
 	for _, tc := range []struct {
@@ -474,7 +483,7 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 	}{
 		{
 			"block", map[string]string{wafMode: block},
-			http.StatusForbidden, requestlog.ActionWAFBlocked, "",
+			http.StatusForbidden, requestlog.ActionBlockedByCoreRuleSet, "",
 		},
 		{
 			"detect", map[string]string{wafMode: detect},
@@ -509,7 +518,7 @@ func TestCoreRuleSetMatchRaisesTheWAFBlockAlert(t *testing.T) {
 			wantAlerts(t, queue, alerts.Alert{
 				Instance: alertInstance,
 				Time:     clk.Now(),
-				Event:    alerts.EventWAFBlock,
+				Event:    alerts.EventCoreRuleSetMatch,
 				Host:     appHost,
 				Client:   netip.MustParseAddr(client),
 				Netblock: netip.MustParsePrefix(client + "/32"),

internal/discriminator/crowdsec.go

@@ -30,10 +30,9 @@ func (crowdSec) check(_ context.Context, rq *request, now time.Time) *verdict {
 	rq.addTag(config.CrowdSecTag)
 	rq.noteHit(bans.ReputationHit{Source: rq.h.config.CrowdSecDecisionsURL},
 		"listed by the CrowdSec decision list")
-	rq.banForCrowdSec(now, decision)
 
 	return &verdict{
-		action: requestlog.ActionBanned,
+		action: rq.banForCrowdSec(now, decision),
 		figures: map[string]any{
 			"scenario": decision.Scenario,
 			"expires":  requestlog.FormatTime(decision.Expires),

internal/discriminator/crowdsec_test.go

@@ -39,7 +39,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	expires := requestlog.FormatTime(fetched.Add(4 * time.Hour))
 
 	// Its first request is refused, and bans it until the decision ends.
-	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if line.BanExpires != expires {
@@ -72,7 +72,7 @@ func TestClientTheCrowdSecDecisionListListsIsBannedUntilTheDecisionEnds(t *testi
 	// ban, and once it has ended the client is let through.
 	clk.advance(4*time.Hour - time.Second)
 
-	line = s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line = s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line)
 
 	if line.BanExpires != expires {
@@ -105,7 +105,7 @@ func TestCrowdSecBanNamesItsHeuristicScenarioAndEnd(t *testing.T) {
 		`"scenario": "crowdsecurity/ssh-bf", "scope": "Ip", "type": "ban", `+
 		`"value": "`+client+`"}]`)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantHeuristic(t, line, "crowdsec", `{"scenario": "crowdsecurity/ssh-bf", `+
 		`"expires": "`+requestlog.FormatTime(clk.Now().Add(4*time.Hour))+`"}`)
 	wantTags(t, line, "crowdsec")
@@ -129,9 +129,9 @@ func TestEndedCrowdSecDecisionNoLongerBansThoughTheCopyStillHoldsIt(t *testing.T
 	// Just before its end, the decision bans a client in the netblock, and
 	// one on an IPv6 address bans the address's group, the /64.
 	clk.advance(time.Minute - time.Nanosecond)
-	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("198.51.100.7", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::9", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
-	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionBanned)
+	s.get("2001:db8::5", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	// Once it has ended, it bans no other client, and the bans it made end
 	// with it.
@@ -164,7 +164,7 @@ func TestObserveModeForwardsAClientTheCrowdSecDecisionListListsAndAlertsTheBan(
 		`"value": "`+client+`"}]`)
 
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 	wantReputation(t, line, decisionsURL)
 
 	if held := server.Ledger.Snapshot(); len(held) != 0 {

internal/discriminator/denynets.go

@@ -19,7 +19,7 @@ func (denyNets) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	for _, netblock := range rq.h.config.DenyNets {
 		if netblock.Contains(rq.client) {
 			return &verdict{
-				action:  requestlog.ActionDenied,
+				action:  requestlog.ActionClientDenied,
 				figures: map[string]any{figureNetblock: netblock.String()},
 			}
 		}

internal/discriminator/discriminator.go

@@ -93,8 +93,8 @@ type Report struct {
 	Status                  int     `json:"status"`
 	RequestBytes            int64   `json:"request_bytes"`
 	ResponseBytes           int64   `json:"response_bytes"`
-	DurationTotal         float64 `json:"duration_total"`
+	DurationTotalMS         float64 `json:"duration_total_ms"`
-	DurationUpstreamTotal float64 `json:"duration_upstream_total"`
+	DurationUpstreamTotalMS float64 `json:"duration_upstream_total_ms"`
 }
 
 // New returns the server `sww discriminator` runs. It answers
@@ -123,6 +123,7 @@ func New(params Params) *Server {
 		Lists:      h.lists,
 		DNSBL:      h.dnsbl,
 		AbuseIPDB:  h.abuseIPDB,
+		RouteWatch: h.routeWatch,
 		Metrics:    h.metrics,
 	}
 }
@@ -182,7 +183,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 	rq.line.DiscriminatorLine = requestlog.DiscriminatorLineDecision
 	refused := rq.check(r.Context())
 	rq.checked = time.Now()
-	underOwnPrefix := strings.HasPrefix(r.URL.Path, adminPrefix)
+	underOwnPrefix := strings.HasPrefix(r.URL.Path, ownEndpointPrefix)
 
 	if refused == nil && !underOwnPrefix {
 		// In observe mode, what enforce mode would have refused counts here.
@@ -207,7 +208,7 @@ func (h *handler) answerQuestion(w http.ResponseWriter, r *http.Request) {
 
 	// The app never sees this prefix. discriminator's own endpoints are at its
 	// own address, so this answers as a path with no endpoint does.
-	rq.line.Action = requestlog.ActionAdmin
+	rq.line.Action = requestlog.ActionOwnEndpoint
 	rq.out.Header().Set(DispositionHeader, DispositionDeny)
 	http.Error(rq.out, http.StatusText(http.StatusNotFound), http.StatusNotFound)
 }
@@ -404,7 +405,7 @@ func readReport(w http.ResponseWriter, r *http.Request) (Report, error) {
 
 	for _, name := range []string{
 		"request_id", "status", "request_bytes", "response_bytes",
-		"duration_total", "duration_upstream_total",
+		"duration_total_ms", "duration_upstream_total_ms",
 	} {
 		value, there := fields[name]
 		if !there || string(value) == "null" {
@@ -430,11 +431,11 @@ func (report *Report) checkRanges() error {
 		return fmt.Errorf("%w: request_bytes", errReportValue)
 	case report.ResponseBytes < 0 || report.ResponseBytes > maxReportedBytes:
 		return fmt.Errorf("%w: response_bytes", errReportValue)
-	case report.DurationTotal < 0 || report.DurationTotal > maxReportedMilliseconds:
+	case report.DurationTotalMS < 0 || report.DurationTotalMS > maxReportedMilliseconds:
-		return fmt.Errorf("%w: duration_total", errReportValue)
+		return fmt.Errorf("%w: duration_total_ms", errReportValue)
-	case report.DurationUpstreamTotal < 0 ||
+	case report.DurationUpstreamTotalMS < 0 ||
-		report.DurationUpstreamTotal > maxReportedMilliseconds:
+		report.DurationUpstreamTotalMS > maxReportedMilliseconds:
-		return fmt.Errorf("%w: duration_upstream_total", errReportValue)
+		return fmt.Errorf("%w: duration_upstream_total_ms", errReportValue)
 	}
 
 	return nil
@@ -458,18 +459,18 @@ func (h *handler) finishWith(ctx context.Context, held *decision, report Report)
 	rq.line.Status = report.Status
 	rq.line.RequestBytes = report.RequestBytes
 	rq.line.ResponseBytes = report.ResponseBytes
-	rq.line.DurationTotal = report.DurationTotal
+	rq.line.DurationTotalMS = report.DurationTotalMS
 
 	if rq.allowed {
-		rq.line.DurationUpstreamTotal = &report.DurationUpstreamTotal
+		rq.line.DurationUpstreamTotalMS = &report.DurationUpstreamTotalMS
 
 		rq.runBanningHeuristics(ctx, onReport())
 		rq.countAnomalies()
 		rq.addToHistory()
 
 		rq.h.metrics.RequestReported(&rq.line,
-			time.Duration(report.DurationTotal*float64(time.Millisecond)),
+			time.Duration(report.DurationTotalMS*float64(time.Millisecond)),
-			time.Duration(report.DurationUpstreamTotal*float64(time.Millisecond)))
+			time.Duration(report.DurationUpstreamTotalMS*float64(time.Millisecond)))
 	}
 
 	rq.writeLine()

internal/discriminator/discriminator_test.go

@@ -48,8 +48,8 @@ const (
 	reportStatus           = "status"
 	reportRequestBytes     = "request_bytes"
 	reportResponseBytes    = "response_bytes"
-	reportDuration         = "duration_total"
+	reportDuration         = "duration_total_ms"
-	reportUpstreamDuration = "duration_upstream_total"
+	reportUpstreamDuration = "duration_upstream_total_ms"
 )
 
 // Discriminator is a discriminator running for one test, on a clock set to midnight.
@@ -639,7 +639,7 @@ func TestQuestionDeniedGetsTheBanResponse(t *testing.T) {
 			got := s.ask(client, "/")
 			wantDisposition(t, got, status, discriminator.DispositionDeny)
 			wantBody(t, got, http.StatusText(status)+"\n")
-			wantLine(t, s.out.requestLine(t), status, requestlog.ActionDenied)
+			wantLine(t, s.out.requestLine(t), status, requestlog.ActionClientDenied)
 		})
 	}
 }
@@ -655,8 +655,8 @@ func TestBanResponseCloseIsAnAnswerOfItsOwn(t *testing.T) {
 	wantDisposition(t, got, http.StatusOK, discriminator.DispositionClose)
 	wantBody(t, got, "")
 	// The visitor is sent nothing.
-	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionDenied)
+	wantLine(t, s.out.requestLine(t), 0, requestlog.ActionClientDenied)
-	wantMetric(t, s.metrics(), `sww_requests_total{action="denied",instance="`+
+	wantMetric(t, s.metrics(), `sww_requests_total{action="client_denied",instance="`+
 		alertInstance+`",status_class="none"}`, 1)
 }
 
@@ -671,12 +671,12 @@ func TestBlockRuleIsDeniedWith403AndABanRuleWithTheBanResponse(t *testing.T) {
 	got := s.ask(client, "/blocked")
 	wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny)
 	wantLine(t, s.out.requestLine(t), http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
 
 	got = s.ask(client, "/.env")
 	wantDisposition(t, got, http.StatusTooManyRequests, discriminator.DispositionDeny)
 	wantLine(t, s.out.requestLines(t, 2)[1], http.StatusTooManyRequests,
-		requestlog.ActionBanned)
+		requestlog.ActionTemporarilyBanned)
 }
 
 func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) {
@@ -693,7 +693,7 @@ func TestQuestionUnderTheOwnPrefixIsDeniedWith404AfterTheChecks(t *testing.T) {
 		wantDisposition(t, got, http.StatusNotFound, discriminator.DispositionDeny)
 	}
 
-	wantLine(t, s.out.requestLine(t), http.StatusNotFound, requestlog.ActionAdmin)
+	wantLine(t, s.out.requestLine(t), http.StatusNotFound, requestlog.ActionOwnEndpoint)
 
 	got := s.ask(otherClient, discriminator.MetricsPath)
 	wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny)
@@ -709,7 +709,7 @@ func TestObserveModeAllowsAndLogsWhatEnforceModeWouldHaveDone(t *testing.T) {
 
 	line := s.out.requestLine(t)
 	wantLine(t, line, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
+	wantWouldAction(t, line, requestlog.ActionClientDenied)
 }
 
 func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
@@ -725,9 +725,9 @@ func TestObserveModeRefusalAnsweredAllowCountsForTheErrorBurst(t *testing.T) {
 	}
 
 	lines := s.out.requestLines(t, 2)
-	if lines[0].LimitHit != "" || lines[1].LimitHit != requestlog.LimitHitErrorBurst {
+	if lines[0].LimitHit != "" || lines[1].LimitHit != requestlog.LimitHitMinuteRefusals {
 		t.Errorf("log lines have limit_hit %q and %q, want none and %q",
-			lines[0].LimitHit, lines[1].LimitHit, requestlog.LimitHitErrorBurst)
+			lines[0].LimitHit, lines[1].LimitHit, requestlog.LimitHitMinuteRefusals)
 	}
 }
 
@@ -744,9 +744,9 @@ func TestDeniedQuestionCountsForTheErrorBurst(t *testing.T) {
 	}
 
 	lines := s.out.requestLines(t, 2)
-	if lines[0].LimitHit != "" || lines[1].LimitHit != requestlog.LimitHitErrorBurst {
+	if lines[0].LimitHit != "" || lines[1].LimitHit != requestlog.LimitHitMinuteRefusals {
 		t.Errorf("log lines have limit_hit %q and %q, want none and %q",
-			lines[0].LimitHit, lines[1].LimitHit, requestlog.LimitHitErrorBurst)
+			lines[0].LimitHit, lines[1].LimitHit, requestlog.LimitHitMinuteRefusals)
 	}
 }
 
@@ -894,14 +894,14 @@ func TestDeniedRequestIsFinishedAtItsDecision(t *testing.T) {
 		t.Errorf("history is %+v, want the refused request alone", history)
 	}
 
-	const series = `sww_requests_total{action="rate_limited",instance="` +
+	const series = `sww_requests_total{action="client_is_rate_limited",instance="` +
 		alertInstance + `",status_class="4xx"}`
 
 	wantMetric(t, s.metrics(), series, 1)
 
 	got := s.report(discriminator.Report{
 		RequestID: denied.Header.Get(requestIDHeader), Status: http.StatusForbidden,
-		ResponseBytes: 1000, DurationTotal: 2,
+		ResponseBytes: 1000, DurationTotalMS: 2,
 	})
 	wantStatus(t, got, http.StatusNoContent)
 
@@ -935,7 +935,7 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	got := s.report(discriminator.Report{
 		RequestID: id, Status: http.StatusBadGateway,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
-		DurationTotal: 5, DurationUpstreamTotal: 4,
+		DurationTotalMS: 5, DurationUpstreamTotalMS: 4,
 	})
 	wantStatus(t, got, http.StatusNoContent)
 
@@ -951,7 +951,8 @@ func TestMetricsCountAnAllowedRequestFromItsReport(t *testing.T) {
 	unscraped := startDiscriminator(t, "", map[string]string{metricsToken: token})
 
 	got = unscraped.report(discriminator.Report{
-		RequestID: unscraped.allowed(client), Status: http.StatusBadGateway, DurationTotal: 5,
+		RequestID: unscraped.allowed(client), Status: http.StatusBadGateway,
+		DurationTotalMS: 5,
 	})
 	wantStatus(t, got, http.StatusNoContent)
 	wantMetric(t, unscraped.metrics(),
@@ -1189,8 +1190,8 @@ func wantReportsFields(t *testing.T, line logLine) {
 	if line.DiscriminatorLine != requestlog.DiscriminatorLineReport ||
 		line.Status != http.StatusCreated ||
 		line.RequestBytes != bodyBytes || line.ResponseBytes != answerBytes ||
-		line.DurationTotal != 12.5 || line.DurationUpstreamTotal == nil ||
+		line.DurationTotalMS != 12.5 || line.DurationUpstreamTotalMS == nil ||
-		*line.DurationUpstreamTotal != 10.25 {
+		*line.DurationUpstreamTotalMS != 10.25 {
 		t.Errorf("the report's line lacks the report's fields: %+v", line.Line)
 	}
 }
@@ -1205,8 +1206,8 @@ func wantSameDecision(t *testing.T, reported, decided logLine) {
 	same.Status = decided.Status
 	same.RequestBytes = decided.RequestBytes
 	same.ResponseBytes = decided.ResponseBytes
-	same.DurationTotal = decided.DurationTotal
+	same.DurationTotalMS = decided.DurationTotalMS
-	same.DurationUpstreamTotal = decided.DurationUpstreamTotal
+	same.DurationUpstreamTotalMS = decided.DurationUpstreamTotalMS
 	same.Counts.MinuteBytes = decided.Counts.MinuteBytes
 	same.Counts.HourBytes = decided.Counts.HourBytes
 	same.Counts.DayBytes = decided.Counts.DayBytes
@@ -1224,7 +1225,7 @@ func wantDecisionsFields(t *testing.T, line logLine, id, query, accept string) {
 
 	if line.DiscriminatorLine != requestlog.DiscriminatorLineDecision ||
 		line.Status != http.StatusOK || line.ResponseBytes != 0 ||
-		line.DurationUpstreamTotal != nil || line.DurationChecks == nil ||
+		line.DurationUpstreamTotalMS != nil || line.DurationChecksMS == nil ||
 		line.RequestID != id || line.Query != query ||
 		!line.HasAuthorization || !line.HasCookie ||
 		line.RequestHeaders["accept"] != accept || len(line.RuleIDs) != 1 ||
@@ -1260,7 +1261,7 @@ func TestReportWritesTheLastLineWithTheDecisionsAndTheReportsFields(t *testing.T
 	got := s.report(discriminator.Report{
 		RequestID: id, Status: http.StatusCreated,
 		RequestBytes: bodyBytes, ResponseBytes: answerBytes,
-		DurationTotal: 12.5, DurationUpstreamTotal: 10.25,
+		DurationTotalMS: 12.5, DurationUpstreamTotalMS: 10.25,
 	})
 	wantStatus(t, got, http.StatusNoContent)
 
@@ -1298,14 +1299,14 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 	}{
 		{
 			"deny", map[string]string{denyNets: client}, "/", http.StatusForbidden,
-			requestlog.ActionDenied,
+			requestlog.ActionClientDenied,
 		},
 		{
 			"close", map[string]string{denyNets: client, banResponse: banResponseClose}, "/",
-			0, requestlog.ActionDenied,
+			0, requestlog.ActionClientDenied,
 		},
 		{"own prefix", nil, discriminator.HealthPath, http.StatusNotFound,
-			requestlog.ActionAdmin},
+			requestlog.ActionOwnEndpoint},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -1317,7 +1318,7 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			do(t, req)
 
 			got := s.report(discriminator.Report{
-				RequestID: id, Status: tc.status, ResponseBytes: 8, DurationTotal: 3,
+				RequestID: id, Status: tc.status, ResponseBytes: 8, DurationTotalMS: 3,
 			})
 			wantStatus(t, got, http.StatusNoContent)
 
@@ -1325,8 +1326,8 @@ func TestEveryDeniedRequestsReportGetsItsLastLine(t *testing.T) {
 			wantLine(t, line, tc.status, tc.action)
 
 			if line.DiscriminatorLine != requestlog.DiscriminatorLineReport ||
-				line.RequestID != id || line.ResponseBytes != 8 || line.DurationTotal != 3 ||
+				line.RequestID != id || line.ResponseBytes != 8 || line.DurationTotalMS != 3 ||
-				line.DurationUpstreamTotal != nil {
+				line.DurationUpstreamTotalMS != nil {
 				t.Errorf("the report's line is %+v", line.Line)
 			}
 		})
@@ -1583,9 +1584,10 @@ func TestCoreRuleSetAlertNamesTheSite(t *testing.T) {
 	wantDisposition(t, got, http.StatusForbidden, discriminator.DispositionDeny)
 
 	waiting := s.queue.Snapshot().Waiting[alerts.DestinationWebhook]
-	if len(waiting) != 1 || waiting[0].Event != alerts.EventWAFBlock ||
+	if len(waiting) != 1 || waiting[0].Event != alerts.EventCoreRuleSetMatch ||
 		waiting[0].Host != siteA {
-		t.Errorf("alerts waiting are %+v, want a waf_block naming %s", waiting, siteA)
+		t.Errorf("alerts waiting are %+v, want a core_rule_set_match naming %s",
+			waiting, siteA)
 	}
 }
 

internal/discriminator/dnsbl.go

@@ -37,7 +37,7 @@ func (dnsbl) check(ctx context.Context, rq *request, _ time.Time) *verdict {
 	}
 
 	return &verdict{
-		action:  requestlog.ActionDenied,
+		action:  requestlog.ActionClientDenied,
 		figures: map[string]any{"zones": listedBy},
 	}
 }

internal/discriminator/headerlimits.go

@@ -30,7 +30,7 @@ func (headerLimits) check(_ context.Context, rq *request, _ time.Time) *verdict
 	}
 
 	return &verdict{
-		action: requestlog.ActionTooLarge,
+		action: requestlog.ActionRequestHeaderTooLarge,
 		figures: map[string]any{
 			"fields": fields, "fields_limit": maxHeaderFields,
 			"cookies": cookies, "cookies_limit": maxCookies,

internal/discriminator/health_test.go

@@ -21,7 +21,8 @@ func TestHealthEndpointCountsTowardNoLimit(t *testing.T) {
 	)
 
 	for range healthChecks {
-		got := s.adminRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
+		got := s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "",
+			http.StatusOK)
 
 		if string(got.body) != "ok\n" || got.header.Get("Content-Type") != contentType {
 			t.Errorf("health endpoint answered %q with Content-Type %q, want ok "+

internal/discriminator/heuristics.go

@@ -44,6 +44,7 @@ const (
 func beforeLookup() []heuristic {
 	return []heuristic{
 		tagLists{},
+		routeWatchTags{},
 		denyNets{},
 		activeBan{},
 	}

internal/discriminator/history_test.go

@@ -31,9 +31,9 @@ func TestHistoryKeepsEachRequestOfTheClient(t *testing.T) {
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 	clk.advance(time.Second)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	clk.advance(time.Second)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 
 	want := ratelimit.History{
 		FirstSeen: start,
@@ -100,8 +100,8 @@ func TestOwnEndpointsAreNotInTheHistory(t *testing.T) {
 
 	s, _, server := startWithClock(t, "", map[string]string{metricsToken: token})
 
-	s.adminRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
+	s.ownEndpointRequest("", http.MethodGet, discriminator.HealthPath, "", http.StatusOK)
-	s.adminRequest("", http.MethodGet, discriminator.MetricsPath, "",
+	s.ownEndpointRequest("", http.MethodGet, discriminator.MetricsPath, "",
 		http.StatusUnauthorized)
 	s.scrape()
 

internal/discriminator/lookup_test.go

@@ -40,7 +40,7 @@ func TestEveryClientIsLookedUpWithoutWaitingWhileNoSettingNeedsIt(t *testing.T)
 	// comes too. None waits for GeoJS.
 	for _, line := range []logLine{
 		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited),
 		s.get(fromKP, http.StatusOK, requestlog.ActionForward),
 	} {
 		got := asnAndCountry{line.ASN, line.ASName, line.Country}
@@ -179,7 +179,7 @@ func TestASNumberAndNameInTheLogLineTheHistoryTheBanNotesAndTheAlert(t *testing.
 
 	for _, line := range []logLine{
 		s.get(fromDE, http.StatusOK, requestlog.ActionForward),
-		s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited),
+		s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited),
 	} {
 		if got := (asnAndCountry{line.ASN, line.ASName, line.Country}); got != want {
 			t.Errorf("log line has %+v, want %+v", got, want)
@@ -264,7 +264,7 @@ func TestClientsAreLookedUpInTheLookupDatabaseAndGeoJSIsNotAsked(t *testing.T) {
 		want asnAndCountry
 	}{
 		{s.get(fromDE, http.StatusOK, requestlog.ActionForward), de},
-		{s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited), de},
+		{s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited), de},
 		{
 			s.get(fromKP, http.StatusForbidden, requestlog.ActionCountryDenied),
 			asnAndCountry{asnKP, asNameKP, "KP"},
@@ -385,7 +385,7 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 		// is never reached.
 		const timeout = 3 * time.Second
 
-		server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
 			map[string]string{
 				lookupTimeout:    timeout.String(),
 				allowedCountries: "DE",
@@ -405,25 +405,25 @@ func TestRequestWaitsAsLongAsTheLookupTimeoutSays(t *testing.T) {
 	})
 }
 
-// unansweredGeoJSURL is where a GeoJS that never answers is asked: a
+// silentGeoJSURL is where a GeoJS that never answers is asked: a
 // request to it waits, without the network, until it is abandoned.
 // TestMain registers it with Go's default transport, through which GeoJS
 // is asked.
-const unansweredGeoJSURL = "unanswered://geojs/v1/ip/geo.json"
+const silentGeoJSURL = "silent://geojs/v1/ip/geo.json"
 
 func TestMain(m *testing.M) {
 	transport, _ := http.DefaultTransport.(*http.Transport)
-	transport.RegisterProtocol("unanswered", unansweredGeoJS{})
+	transport.RegisterProtocol("silent", silentGeoJS{})
 	transport.RegisterProtocol("abuseipdb", abuseIPDBStandIn{})
 
 	m.Run()
 }
 
-// unansweredGeoJS is the GeoJS at unansweredGeoJSURL.
+// silentGeoJS is the GeoJS at silentGeoJSURL.
-type unansweredGeoJS struct{}
+type silentGeoJS struct{}
 
 // RoundTrip waits until req is abandoned.
-func (unansweredGeoJS) RoundTrip(req *http.Request) (*http.Response, error) {
+func (silentGeoJS) RoundTrip(req *http.Request) (*http.Response, error) {
 	<-req.Context().Done()
 
 	return nil, req.Context().Err()

internal/discriminator/metrics_test.go

@@ -32,7 +32,7 @@ func TestMetricsAreOffWhileTheTokenIsUnset(t *testing.T) {
 
 	// An empty token does not match the unset one either.
 	for _, authorization := range []string{bearer, "Bearer ", ""} {
-		s.adminRequest(authorization, http.MethodGet, discriminator.MetricsPath, "",
+		s.ownEndpointRequest(authorization, http.MethodGet, discriminator.MetricsPath, "",
 			http.StatusNotFound)
 	}
 }
@@ -60,7 +60,7 @@ func TestMetricsNeedTheTokenAndOtherPathsAreNotFound(t *testing.T) {
 		{http.MethodGet, "/_sww/bans", bearer, http.StatusNotFound},
 		{http.MethodPost, discriminator.HealthPath, "", http.StatusNotFound},
 	} {
-		got := s.adminRequest(tc.authorization, tc.method, tc.path, "", tc.status)
+		got := s.ownEndpointRequest(tc.authorization, tc.method, tc.path, "", tc.status)
 
 		if tc.status == http.StatusUnauthorized &&
 			got.header.Get("WWW-Authenticate") != "Bearer" {
@@ -91,7 +91,7 @@ func TestMetricsCountTheTraffic(t *testing.T) {
 	out.endedLines(t, 2)
 
 	forward := `{action="forward",instance="app",status_class="2xx"}`
-	notFound := `{action="admin",instance="app",status_class="4xx"}`
+	notFound := `{action="own_endpoint",instance="app",status_class="4xx"}`
 
 	// The request for the metrics is itself under way.
 	metrics := scrape(t, server.Addr)
@@ -125,15 +125,15 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	})
 
 	// SWW_BAN_RESPONSE=close sends no status at all.
-	s.get(denied, 0, requestlog.ActionDenied)
+	s.get(denied, 0, requestlog.ActionClientDenied)
 
 	// A first broken limit bans for an hour.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionRateLimited)
+	s.get(client, 0, requestlog.ActionClientIsRateLimited)
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
-		`sww_requests_total{action="denied",instance="app",status_class="none"}`, 1)
+		`sww_requests_total{action="client_denied",instance="app",status_class="none"}`, 1)
 	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
 		`kind="requests",window="minute"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
@@ -147,7 +147,7 @@ func TestMetricsCountLimitsAndBans(t *testing.T) {
 	// A limit broken again right after would ban for three hours, longer
 	// than SWW_MAX_BAN_DURATION, so the ban is permanent.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	s.get(client, 0, requestlog.ActionRateLimited)
+	s.get(client, 0, requestlog.ActionClientIsRateLimited)
 
 	metrics = s.scrape()
 	wantMetric(t, metrics, `sww_rate_limit_hits_total{instance="app",`+
@@ -347,7 +347,7 @@ func TestMetricsCountGeoJSRequestsAndFailures(t *testing.T) {
 
 	wantMetric(t, metrics, `sww_geojs_requests_total{instance="app"}`, 1)
 	wantMetric(t, metrics, `sww_geojs_failures_total{instance="app"}`, 1)
-	wantMetric(t, metrics, `sww_geojs_unanswered_total{instance="app"}`, 1)
+	wantMetric(t, metrics, `sww_requests_without_geojs_answer_total{instance="app"}`, 1)
 }
 
 // keptAnswer returns GeoJS's answer that the client at addr is in
@@ -381,8 +381,8 @@ func scrape(t *testing.T, addr string) string {
 func (s *sender) scrape() string {
 	s.t.Helper()
 
-	return string(s.adminRequest(bearer, http.MethodGet, discriminator.MetricsPath, "",
+	return string(s.ownEndpointRequest(bearer, http.MethodGet, discriminator.MetricsPath,
-		http.StatusOK).body)
+		"", http.StatusOK).body)
 }
 
 // metric returns the value of series in metrics, which are in the

internal/discriminator/observe_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 )
@@ -14,6 +15,93 @@ import (
 // observe is the value of SWW_MODE for observe mode.
 const observe = "observe"
 
+func TestBanActionSaysWhetherTheBanRunsOut(t *testing.T) {
+	t.Parallel()
+
+	const trapPath = "/wp-login.php"
+
+	for _, tc := range []struct {
+		name  string
+		cause string
+		// endsIn is how long after the request the ban ends: negative for a
+		// ban that has ended, and zero for a permanent ban.
+		endsIn time.Duration
+		path   string
+		want   string
+	}{
+		{
+			"temporary ban", bans.CauseAdmin, time.Hour, "/",
+			requestlog.ActionTemporarilyBanned,
+		},
+		{"permanent ban", bans.CauseAdmin, 0, "/", requestlog.ActionPermanentlyBanned},
+		{
+			"request that makes a ban permanent", bans.CauseAttack, time.Hour, "/",
+			requestlog.ActionPermanentlyBanned,
+		},
+		{
+			"trap path after an attack ban ended", bans.CauseAttack, -time.Hour,
+			trapPath, requestlog.ActionPermanentlyBanned,
+		},
+		{
+			"first trap path after another ban ended", bans.CauseAdmin, -time.Hour,
+			trapPath, requestlog.ActionTemporarilyBanned,
+		},
+	} {
+		for _, modeValue := range []string{"enforce", observe} {
+			t.Run(tc.name+" in "+modeValue, func(t *testing.T) {
+				t.Parallel()
+
+				s, clk, server := startWithClock(t, "", map[string]string{
+					trapPaths: trapPathList, mode: modeValue,
+				})
+
+				ban := bans.Ban{
+					Netblock: netip.MustParsePrefix(client + "/32"),
+					Start:    clk.Now().Add(-2 * time.Hour),
+					Cause:    tc.cause,
+				}
+				if tc.endsIn != 0 {
+					ban.Expires = clk.Now().Add(tc.endsIn)
+				}
+
+				server.Ledger.Load([]bans.Ban{ban})
+
+				if modeValue == observe {
+					line := s.request(client, tc.path, http.StatusOK, requestlog.ActionForward)
+					wantWouldAction(t, line, tc.want)
+
+					return
+				}
+
+				s.request(client, tc.path, http.StatusForbidden, tc.want)
+			})
+		}
+	}
+}
+
+func TestObserveModeNamesAPermanentBanWhoseAlertWouldBeSent(t *testing.T) {
+	t.Parallel()
+
+	s, clk, server, queue := startWithAlerts(t, map[string]string{
+		trapPaths: trapPathList, mode: observe,
+	})
+
+	server.Ledger.Load([]bans.Ban{{
+		Netblock: netip.MustParsePrefix(client + "/32"),
+		Start:    clk.Now().Add(-2 * time.Hour),
+		Expires:  clk.Now().Add(-time.Hour),
+		Cause:    bans.CauseAttack,
+	}})
+
+	line := s.request(client, "/wp-login.php", http.StatusOK, requestlog.ActionForward)
+	wantWouldAction(t, line, requestlog.ActionPermanentlyBanned)
+
+	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
+	if len(waiting) != 1 || waiting[0].Event != alerts.EventPermanentBan {
+		t.Errorf("alerts waiting are %+v, want one %s", waiting, alerts.EventPermanentBan)
+	}
+}
+
 func TestObserveModeNamesTheHeuristicThatWouldHaveRefused(t *testing.T) {
 	t.Parallel()
 
@@ -22,7 +110,7 @@ func TestObserveModeNamesTheHeuristicThatWouldHaveRefused(t *testing.T) {
 	})
 
 	line := s.get(client, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
+	wantWouldAction(t, line, requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+client+`/32"}`)
 }
 
@@ -69,10 +157,10 @@ func TestObserveModeForwardsWhatEnforceModeRefuses(t *testing.T) {
 			s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 
 			for _, sent := range []struct{ from, refusal string }{
-				{denied, requestlog.ActionDenied},
+				{denied, requestlog.ActionClientDenied},
-				{banned, requestlog.ActionBanned},
+				{banned, requestlog.ActionTemporarilyBanned},
-				{fromKP, requestlog.ActionDenied},
+				{fromKP, requestlog.ActionClientDenied},
-				{fromDE, requestlog.ActionRateLimited},
+				{fromDE, requestlog.ActionClientIsRateLimited},
 			} {
 				if !tc.observe {
 					line := s.get(sent.from, http.StatusForbidden, sent.refusal)
@@ -110,7 +198,7 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 
 	for range 2 {
 		line := s.get(client, http.StatusOK, requestlog.ActionForward)
-		wantWouldAction(t, line, requestlog.ActionRateLimited)
+		wantWouldAction(t, line, requestlog.ActionClientIsRateLimited)
 
 		if line.LimitHit != minute || line.Offence != requestlog.OffenceLimit ||
 			line.BanExpires != "" {
@@ -123,7 +211,7 @@ func TestObserveModeMakesNoBanAndKeepsTheBansItHas(t *testing.T) {
 	// The ban read from bans.json refuses nothing, and so counts no
 	// refusal in its notes, but is kept.
 	line := s.get(otherClient, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 
 	if line.BanExpires != requestlog.FormatTime(kept.Expires) {
 		t.Errorf("log line has ban_expires %q, want %s", line.BanExpires,

internal/discriminator/proxy.go

@@ -16,17 +16,18 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/anomaly"
 	"sneak.berlin/go/smallwebwaf/internal/bans"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/metrics"
 	"sneak.berlin/go/smallwebwaf/internal/ratelimit"
 	"sneak.berlin/go/smallwebwaf/internal/reputation"
+	"sneak.berlin/go/smallwebwaf/internal/routewatch"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
-	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
-// adminPrefix starts the path of each of discriminator's own endpoints. The app never
+// ownEndpointPrefix starts the path of each of discriminator's own endpoints. The app
-// sees a path under it.
+// never sees a path under it.
-const adminPrefix = "/_sww/"
+const ownEndpointPrefix = "/_sww/"
 
 // HealthPath is the health endpoint of discriminator and of rproxy, which the
 // container's health check asks.
@@ -64,7 +65,7 @@ type Params struct {
 	LookupFile *lookup.File
 	// CoreRuleSet is what NewCoreRuleSet returns: what inspects requests
 	// while SWW_WAF_MODE is not off, and nil while it is.
-	CoreRuleSet *waf.CoreRuleSet
+	CoreRuleSet *coreruleset.CoreRuleSet
 	// Now tells the time by which requests are counted for the rate
 	// limits, bans are made and run out, and GeoJS's answers are kept,
 	// normally time.Now in UTC, the time the state files give.
@@ -85,7 +86,8 @@ type Params struct {
 // Server is the server discriminator runs, with the parts whose state the state
 // files keep, the lookup database, nil unless SWW_LOOKUP_SOURCE is file, the
 // lists fetched from URLs, which its Run fetches, the DNSBL zones' verdicts,
-// AbuseIPDB's scores and checks spent, and the metrics.
+// AbuseIPDB's scores and checks spent, and the metrics. RouteWatch, nil while
+// SWW_ROUTEWATCH_URL is unset, keeps its answers in memory only.
 type Server struct {
 	*http.Server
 
@@ -97,6 +99,7 @@ type Server struct {
 	Lists      *reputation.Lists
 	DNSBL      *reputation.DNSBL
 	AbuseIPDB  *reputation.AbuseIPDB
+	RouteWatch *routewatch.Client
 	Metrics    *metrics.Metrics
 }
 
@@ -126,7 +129,7 @@ func newHandler(params Params) *handler {
 			BytesPerHour:   params.Config.BytesLimitPerHour,
 			BytesPerDay:    params.Config.BytesLimitPerDay,
 		}, params.Config.MaxTrackedClients),
-		ledger: bans.New(bans.Rules{
+		ledger: bans.New(bans.Params{
 			LimitBanDuration:     params.Config.LimitBanDuration,
 			LimitBanRepeatWindow: params.Config.LimitBanRepeatWindow,
 			MaxBanDuration:       params.Config.MaxBanDuration,
@@ -152,6 +155,12 @@ func newHandler(params Params) *handler {
 		coreRuleSet: params.CoreRuleSet,
 		alerts:      params.Alerts,
 	}
+	if params.Config.RouteWatchURL != "" {
+		h.routeWatch = routewatch.New(routewatch.Params{
+			URL: params.Config.RouteWatchURL, Now: params.Now, ProcessLog: params.ProcessLog,
+		})
+	}
+
 	h.geojs = lookup.New(lookup.Params{
 		URL:     params.GeoJSURL,
 		Timeout: params.Config.LookupTimeout,
@@ -215,15 +224,15 @@ func newReputation(
 // SWW_CORE_RULE_SET_EXCLUSIONS_FILE, or nil while SWW_WAF_MODE is off. It
 // reads at most QuestionBodyMaxBytes less one byte: a question's body of
 // QuestionBodyMaxBytes may be cut short, and the Core Rule Set does not read a
-// JSON or XML body over its limit. An exclusions file that waf.New refuses is
+// JSON or XML body over its limit. An exclusions file that coreruleset.New refuses is
 // an error in every mode. While the mode is off, a set file is loaded with the
 // Core Rule Set only to check it.
-func NewCoreRuleSet(cfg *config.Config) (*waf.CoreRuleSet, error) {
+func NewCoreRuleSet(cfg *config.Config) (*coreruleset.CoreRuleSet, error) {
 	if cfg.WAFMode == config.WAFModeOff && cfg.CoreRuleSetExclusionsFile == "" {
 		return nil, nil //nolint:nilnil // off is no Core Rule Set, and no error
 	}
 
-	coreRuleSet, err := waf.New(waf.Params{
+	coreRuleSet, err := coreruleset.New(coreruleset.Params{
 		ParanoiaLevel: cfg.WAFParanoiaLevel, DisabledRules: cfg.WAFDisabledRules,
 		BodyLimit:      min(cfg.WAFBodyLimit, QuestionBodyMaxBytes-1),
 		ExclusionsFile: cfg.CoreRuleSetExclusionsFile,
@@ -255,8 +264,9 @@ type handler struct {
 	lists       *reputation.Lists
 	dnsbl       *reputation.DNSBL
 	abuseIPDB   *reputation.AbuseIPDB
+	routeWatch  *routewatch.Client
 	rules       *rules.Files
-	coreRuleSet *waf.CoreRuleSet
+	coreRuleSet *coreruleset.CoreRuleSet
 	alerts      *alerts.Queue
 	// awaitingReport holds the decision on each answered question by its id
 	// until its report comes, and nil for a question still being handled.

internal/discriminator/ratelimits.go

@@ -28,12 +28,14 @@ func (rateLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 		return nil
 	}
 
-	rq.limitPercent, rq.bytesPercent = rq.limitPercentages()
+	rq.rateLimitPercent, rq.bytesLimitPercent = rq.limitPercentages()
-	rq.line.LimitPercent, rq.line.LimitPercentSetting = rq.limitPercent.logged()
+	rq.line.RateLimitPercent, rq.line.RateLimitPercentSetting =
-	rq.line.BytesPercent, rq.line.BytesPercentSetting = rq.bytesPercent.logged()
+		rq.rateLimitPercent.logged()
+	rq.line.BytesLimitPercent, rq.line.BytesLimitPercentSetting =
+		rq.bytesLimitPercent.logged()
 
 	counts, hit, over := rq.h.limiter.Count(rq.h.clientGroup(rq.client), now,
-		rq.limitPercent.percent)
+		rq.rateLimitPercent.percent)
 	rq.line.Counts = counts
 
 	if !over {
@@ -42,7 +44,9 @@ func (rateLimits) check(_ context.Context, rq *request, now time.Time) *verdict
 
 	rq.banForLimit(now, hit, rq.h.config.BanResponse)
 
-	return &verdict{action: requestlog.ActionRateLimited, figures: limitFigures(hit)}
+	return &verdict{
+		action: requestlog.ActionClientIsRateLimited, figures: limitFigures(hit),
+	}
 }
 
 // overAWholeRateLimit reports whether the heuristic rate_limits will refuse the

internal/discriminator/ratelimits_test.go

@@ -59,7 +59,7 @@ func TestRateLimitRefusesBeforeTheApp(t *testing.T) {
 		if sent.want == http.StatusOK {
 			wantLine(t, line, http.StatusOK, requestlog.ActionForward)
 		} else {
-			wantLine(t, line, http.StatusForbidden, requestlog.ActionRateLimited)
+			wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
 			if line.LimitHit != minute {
 				t.Errorf("log line has limit_hit %q, want minute", line.LimitHit)
@@ -79,7 +79,7 @@ func TestRateLimitRefusalNamesItsHeuristicWindowCountAndLimit(t *testing.T) {
 
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	wantHeuristic(t, line, "rate_limits", `{"window": "minute", "count": 2, "limit": 1}`)
 }
 
@@ -102,7 +102,7 @@ func TestIPv6GroupPrefixSetsTheClientTheLimitsCount(t *testing.T) {
 		status int
 		action string
 	}{
-		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionRateLimited},
+		{rateLimitPerMinute, "1", http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 		{bytesLimitPerMinute, byteLimit, http.StatusOK, requestlog.ActionForward},
 	} {
 		t.Run(tc.setting, func(t *testing.T) {
@@ -160,14 +160,17 @@ func TestRateLimitExemptPathsAreNeitherCountedNorRefused(t *testing.T) {
 
 	// A path outside every prefix is counted: /assets is not under
 	// /assets/, and breaks the limit.
-	s.request(client, "/assets", http.StatusForbidden, requestlog.ActionRateLimited)
+	s.request(client, "/assets", http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited)
 
 	// A ban, SWW_DENY_NETS and SWW_TAG_DENY still refuse a path under a
 	// prefix.
-	s.request(client, "/assets/app.js", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/assets/app.js", http.StatusForbidden,
-	s.request(denied, "/assets/app.js", http.StatusForbidden, requestlog.ActionDenied)
+		requestlog.ActionTemporarilyBanned)
+	s.request(denied, "/assets/app.js", http.StatusForbidden,
+		requestlog.ActionClientDenied)
 	s.request(fromKP, "/assets/app.js",
-		http.StatusForbidden, requestlog.ActionDenied)
+		http.StatusForbidden, requestlog.ActionClientDenied)
 }
 
 func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
@@ -211,7 +214,7 @@ func TestRateLimitCountsPathsThatAreNotExempt(t *testing.T) {
 			// Counted, the second request breaks the limit of one request
 			// a minute.
 			s.request(client, sent, http.StatusOK, requestlog.ActionForward)
-			s.request(client, sent, http.StatusForbidden, requestlog.ActionRateLimited)
+			s.request(client, sent, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 		})
 	}
 }

internal/discriminator/refusallimit.go

@@ -28,7 +28,7 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 		return nil
 	}
 
-	if !rq.attack && !rq.ruleBlocked && !rq.wafBlocked {
+	if !rq.attack && !rq.blockedByBlockRule && !rq.blockedByCoreRuleSet {
 		return nil
 	}
 
@@ -42,13 +42,13 @@ func (refusalLimit) check(_ context.Context, rq *request, now time.Time) *verdic
 	status := rq.out.status
 
 	switch rq.line.WouldAction {
-	case requestlog.ActionRuleBlocked, requestlog.ActionWAFBlocked:
+	case requestlog.ActionBlockedByBlockRule, requestlog.ActionBlockedByCoreRuleSet:
 		status = http.StatusForbidden
-	case requestlog.ActionBanned:
+	case requestlog.ActionTemporarilyBanned, requestlog.ActionPermanentlyBanned:
 		status = cfg.BanResponse
 	}
 
 	rq.banForLimit(now, hit, status)
 
-	return &verdict{action: requestlog.ActionBanned, figures: limitFigures(hit)}
+	return &verdict{figures: limitFigures(hit)}
 }

internal/discriminator/refusallimit_test.go

@@ -37,9 +37,10 @@ func (r refused) send(s *sender, from string) logLine {
 	switch r {
 	case blockRule:
 		return s.request(from, blockedPath, http.StatusForbidden,
-			requestlog.ActionRuleBlocked)
+			requestlog.ActionBlockedByBlockRule)
 	case banRule:
-		return s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
+		return s.request(from, probePath, http.StatusForbidden,
+			requestlog.ActionTemporarilyBanned)
 	}
 
 	s.t.Fatalf("no request for the refusal %d", r)
@@ -71,9 +72,20 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 		name string
 		// refusals are four, one over the threshold of three.
 		refusals []refused
+		// nextAction is the action of the client's next request: the next
+		// request after a ban for a ban rule makes it permanent.
+		nextAction string
 	}{
-		{"block rule", []refused{blockRule, blockRule, blockRule, blockRule}},
+		{
-		{"a ban rule last", []refused{blockRule, blockRule, blockRule, banRule}},
+			"block rule",
+			[]refused{blockRule, blockRule, blockRule, blockRule},
+			requestlog.ActionTemporarilyBanned,
+		},
+		{
+			"a ban rule last",
+			[]refused{blockRule, blockRule, blockRule, banRule},
+			requestlog.ActionPermanentlyBanned,
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -95,13 +107,13 @@ func TestErrorBurstBreaksAtOneOverTheThreshold(t *testing.T) {
 			// The fourth is answered as the others were, breaks the error
 			// burst, and bans the client.
 			line := tc.refusals[3].send(s, client)
-			if line.LimitHit != requestlog.LimitHitErrorBurst ||
+			if line.LimitHit != requestlog.LimitHitMinuteRefusals ||
 				line.Offence != requestlog.OffenceLimit {
-				t.Errorf("log line has limit_hit %q and offence %q, want error_burst "+
+				t.Errorf("log line has limit_hit %q and offence %q, want minute_refusals "+
 					"and limit", line.LimitHit, line.Offence)
 			}
 
-			s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+			s.get(client, http.StatusForbidden, tc.nextAction)
 		})
 	}
 }
@@ -169,7 +181,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		t.Fatalf("bans\n%+v\nwant\n%+v", got, want)
 	}
 
-	wantOffences := ratelimit.Offences{Limit: 1, RuleBlocked: 3}
+	wantOffences := ratelimit.Offences{Limit: 1, BlockedByBlockRule: 3}
 	if offences := historyOf(t, server, client).Offences; offences != wantOffences {
 		t.Errorf("history counts the offences %+v, want %+v", offences, wantOffences)
 	}
@@ -179,7 +191,7 @@ func TestErrorBurstBanNotesHistoryAndMetrics(t *testing.T) {
 		`kind="refusals",window="minute"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="limit"}`, 1)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="rule_blocked"}`, 3)
+		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 3)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 1)
 }
 
@@ -265,7 +277,8 @@ func TestErrorBurstOffOrAtItsDefault(t *testing.T) {
 				line = blockRule.send(s, client)
 			}
 
-			if broken := line.LimitHit == requestlog.LimitHitErrorBurst; broken != tc.broken {
+			broken := line.LimitHit == requestlog.LimitHitMinuteRefusals
+			if broken != tc.broken {
 				t.Errorf("the 31st refusal broke the error burst: %t, want %t",
 					broken, tc.broken)
 			}
@@ -294,11 +307,11 @@ func TestErrorBurstCountsEachClientTheChecksApplyTo(t *testing.T) {
 	blockRule.send(s, exempt)
 
 	line := blockRule.send(s, exempt)
-	if line.LimitHit != requestlog.LimitHitErrorBurst {
+	if line.LimitHit != requestlog.LimitHitMinuteRefusals {
-		t.Errorf("log line has limit_hit %q, want error_burst", line.LimitHit)
+		t.Errorf("log line has limit_hit %q, want minute_refusals", line.LimitHit)
 	}
 
-	s.get(exempt, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(exempt, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestErrorBurstBanSetsTheRefusalsBackToZero(t *testing.T) {
@@ -341,7 +354,7 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	for range 2 {
 		line := s.request(otherClient, blockedPath, http.StatusOK,
 			requestlog.ActionForward)
-		wantWouldAction(t, line, requestlog.ActionBanned)
+		wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 
 		if line.LimitHit != "" {
 			t.Errorf("log line has limit_hit %q, want none", line.LimitHit)
@@ -353,10 +366,10 @@ func TestObserveModeLogsAndAlertsTheErrorBurst(t *testing.T) {
 	s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
 
 	line := s.request(client, blockedPath, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
 
-	if line.LimitHit != requestlog.LimitHitErrorBurst || line.BanExpires != "" {
+	if line.LimitHit != requestlog.LimitHitMinuteRefusals || line.BanExpires != "" {
-		t.Errorf("log line has limit_hit %q and ban_expires %q, want error_burst "+
+		t.Errorf("log line has limit_hit %q and ban_expires %q, want minute_refusals "+
 			"and none", line.LimitHit, line.BanExpires)
 	}
 

internal/discriminator/reputation_test.go

@@ -49,12 +49,12 @@ const (
 func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
 
 	for _, tc := range []struct {
 		action string
 		// statuses and actions are those of a listed client's three
-		// requests, and percent their limit_percent, as percentText gives it.
+		// requests, and percent their rate_limit_percent, as percentText gives it.
 		statuses []int
 		actions  []string
 		percent  string
@@ -66,7 +66,7 @@ func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
+			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
 			"50 from " + blocklistAction,
 		},
 		{
@@ -90,8 +90,8 @@ func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 				for i := range 3 {
 					line := s.get(from, tc.statuses[i], tc.actions[i])
 					wantReputation(t, line, dropURL)
-					wantPercent(t, "limit_percent", line.LimitPercent,
+					wantPercent(t, "rate_limit_percent", line.RateLimitPercent,
-						line.LimitPercentSetting, tc.percent)
+						line.RateLimitPercentSetting, tc.percent)
 
 					// A request refused for the list is not counted.
 					counted := line.fields["counts"] != nil
@@ -106,7 +106,8 @@ func TestEachBlocklistActionForAListedAddressAndAListedNetblock(t *testing.T) {
 			for range 3 {
 				line := s.get(unplaced, http.StatusOK, forward)
 				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
 			}
 
@@ -162,7 +163,7 @@ func TestReputationRefusalNamesItsHeuristicAndWhatListedTheClient(t *testing.T)
 			s, server, _ := startWithLookups(t, tc.env)
 			tc.load(t, server)
 
-			line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
+			line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
 			wantHeuristic(t, line, tc.heuristic, tc.figures)
 		})
 	}
@@ -193,7 +194,7 @@ func TestObserveModeForwardsAClientABlocklistDeniesAndAlertsIt(t *testing.T) {
 	loadLists(t, server, map[string][]string{dropURL: {fromDE}})
 
 	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
+	wantWouldAction(t, line, requestlog.ActionClientDenied)
 	wantReputation(t, line, dropURL)
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -207,7 +208,7 @@ func TestBlocklistLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T)
 
 	for _, tc := range []struct {
 		action, asnPercent string
-		// want is the upload's limit_percent and bytes_percent, as
+		// want is the upload's rate_limit_percent and bytes_limit_percent, as
 		// percentText gives them, and limitHit its limit_hit.
 		want, limitHit string
 	}{
@@ -229,9 +230,11 @@ func TestBlocklistLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T)
 			// The upload's 100 bytes are over 49, a quarter of 199, and 99,
 			// half of it, and within 199.
 			line := s.uploadFrom(fromDE)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
+				line.RateLimitPercent, line.RateLimitPercentSetting,
 				tc.want)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
 				tc.want)
 
 			if line.LimitHit != tc.limitHit {
@@ -253,9 +256,9 @@ func TestASNLimitPercentFileCountsAsTheSettingDoesTheLowerWinning(t *testing.T)
 		name string
 		env  map[string]string
 		file string
-		// limitPercent and bytesPercent are the upload's, as percentText
+		// rateLimitPercent and bytesLimitPercent are the upload's, as
-		// gives them.
+		// percentText gives them.
-		limitPercent, bytesPercent string
+		rateLimitPercent, bytesLimitPercent string
 	}{
 		{"the file's alone", nil, asnDEQuarter, fromURL, fromURL},
 		{
@@ -288,10 +291,12 @@ func TestASNLimitPercentFileCountsAsTheSettingDoesTheLowerWinning(t *testing.T)
 			loadLists(t, server, map[string][]string{asnURL: {"# by AS number", tc.file}})
 
 			line := s.uploadFrom(fromDE)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
-				tc.limitPercent)
+				line.RateLimitPercent, line.RateLimitPercentSetting,
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+				tc.rateLimitPercent)
-				tc.bytesPercent)
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
+				tc.bytesLimitPercent)
 		})
 	}
 }
@@ -380,12 +385,12 @@ const (
 func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
 
 	for _, tc := range []struct {
 		action string
 		// statuses and actions are those of a listed client's three
-		// requests, and percent their limit_percent, as percentText gives it.
+		// requests, and percent their rate_limit_percent, as percentText gives it.
 		statuses []int
 		actions  []string
 		percent  string
@@ -397,7 +402,7 @@ func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
+			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
 			"50 from " + reputationAction,
 		},
 		{
@@ -422,8 +427,8 @@ func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 					line := s.get(from, tc.statuses[i], tc.actions[i])
 					// In the order SWW_DNSBL_ZONES names them.
 					wantReputation(t, line, listedBy[from]...)
-					wantPercent(t, "limit_percent", line.LimitPercent,
+					wantPercent(t, "rate_limit_percent", line.RateLimitPercent,
-						line.LimitPercentSetting, tc.percent)
+						line.RateLimitPercentSetting, tc.percent)
 
 					// A request refused for the verdict is not counted.
 					counted := line.fields["counts"] != nil
@@ -438,7 +443,8 @@ func TestEachReputationActionForAClientADNSBLZoneLists(t *testing.T) {
 			for range 3 {
 				line := s.get(unplaced, http.StatusOK, forward)
 				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
 			}
 
@@ -468,7 +474,7 @@ func TestDNSBLZonesComeAfterTheBlocklistsAndSkipAllowNets(t *testing.T) {
 	// The blocklist refuses fromKP before its verdict is looked at, and
 	// fromDE, in SWW_ALLOW_NETS, is not checked at all: neither is noted
 	// for the zone, nor alerted, nor asked about.
-	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
+	wantReputation(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied),
 		dropURL)
 	wantReputation(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward))
 
@@ -532,7 +538,7 @@ func TestObserveModeForwardsAClientADNSBLZoneDeniesAndAlertsIt(t *testing.T) {
 	loadVerdicts(server, map[string][]string{fromDE: {dnsblZone}})
 
 	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionDenied)
+	wantWouldAction(t, line, requestlog.ActionClientDenied)
 	wantReputation(t, line, dnsblZone)
 
 	waiting := queue.Snapshot().Waiting[alerts.DestinationWebhook]
@@ -546,7 +552,7 @@ func TestReputationLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T)
 
 	for _, tc := range []struct {
 		blocklistAction, reputationAction string
-		// want is the request's limit_percent and bytes_percent, as
+		// want is the request's rate_limit_percent and bytes_limit_percent, as
 		// percentText gives them.
 		want string
 	}{
@@ -571,9 +577,11 @@ func TestReputationLimitTakesPartInTheLowestPercentageOfEveryLimit(t *testing.T)
 			// Named by the blocklist, then by the zone.
 			line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 			wantReputation(t, line, dropURL, dnsblZone)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
+				line.RateLimitPercent, line.RateLimitPercentSetting,
 				tc.want)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
 				tc.want)
 		})
 	}
@@ -741,8 +749,8 @@ func TestOnlyAClientThatHasCommittedAnOffenceIsCheckedWithAbuseIPDB(t *testing.T
 	s.get(fromDE, http.StatusOK, forward)
 	s.get(fromDE, http.StatusOK, forward)
 	s.get(fromKP, http.StatusOK, forward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	wantAbuseIPDBChecks(t, server, 0)
 
 	// Once the ban has ended, fromDE's first request has it checked in the
@@ -781,7 +789,7 @@ func TestIPv6ClientCostsOneAbuseIPDBCheckWhicheverOfItsAddressesSends(t *testing
 		s.get(addresses[0], http.StatusOK, forward)
 	}
 
-	s.get(addresses[0], http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(addresses[0], http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	clk.advance(time.Hour)
 
 	// Once the ban has ended, which set its counters back to zero, a
@@ -814,20 +822,20 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 		want   ratelimit.Offences
 	}{
 		{
-			"a block rule", blockedPath, http.StatusForbidden, requestlog.ActionRuleBlocked,
+			"a block rule", blockedPath, http.StatusForbidden,
-			ratelimit.Offences{RuleBlocked: 1},
+			requestlog.ActionBlockedByBlockRule, ratelimit.Offences{BlockedByBlockRule: 1},
 		},
 		{
 			"the Core Rule Set", sqlInjection, http.StatusForbidden,
-			requestlog.ActionWAFBlocked, ratelimit.Offences{WAFBlocked: 1},
+			requestlog.ActionBlockedByCoreRuleSet, ratelimit.Offences{BlockedByCoreRuleSet: 1},
 		},
 		{
-			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionBanned,
+			"a ban rule", probePath, http.StatusForbidden, requestlog.ActionTemporarilyBanned,
 			ratelimit.Offences{Attack: 1},
 		},
 		{
-			"a trap path", "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned,
+			"a trap path", "/xmlrpc.php", http.StatusForbidden,
-			ratelimit.Offences{Attack: 1},
+			requestlog.ActionTemporarilyBanned, ratelimit.Offences{Attack: 1},
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -858,12 +866,12 @@ func TestClientRefusedForAnOffenceIsCheckedWithAbuseIPDBAtItsNextRequest(t *test
 func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *testing.T) {
 	t.Parallel()
 
-	forward, denied := requestlog.ActionForward, requestlog.ActionDenied
+	forward, denied := requestlog.ActionForward, requestlog.ActionClientDenied
 
 	for _, tc := range []struct {
 		action string
 		// statuses and actions are those of fromDE's three requests, and
-		// percent their limit_percent, as percentText gives it.
+		// percent their rate_limit_percent, as percentText gives it.
 		statuses []int
 		actions  []string
 		percent  string
@@ -875,7 +883,7 @@ func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *test
 		{
 			// Half of 4 requests a minute: the third breaks the limit.
 			limitHalf, []int{http.StatusOK, http.StatusOK, http.StatusForbidden},
-			[]string{forward, forward, requestlog.ActionRateLimited},
+			[]string{forward, forward, requestlog.ActionClientIsRateLimited},
 			"50 from " + reputationAction,
 		},
 		{
@@ -896,7 +904,8 @@ func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *test
 			for i := range 3 {
 				line := s.get(fromDE, tc.statuses[i], tc.actions[i])
 				wantReputation(t, line, abuseipdb)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					tc.percent)
 
 				// A request refused for the score is not counted.
@@ -910,7 +919,8 @@ func TestEachReputationActionForAClientAbuseIPDBScoresAtOrOverTheMinimum(t *test
 			for range 3 {
 				line := s.get(fromKP, http.StatusOK, forward)
 				wantReputation(t, line)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
 			}
 
@@ -972,7 +982,7 @@ func TestWithoutAnAbuseIPDBKeyNoClientIsCheckedNorAScoreUsed(t *testing.T) {
 	// fromDE's score is not used, and once it has committed an offence it
 	// is not checked either.
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 	clk.advance(time.Hour)
 	wantReputation(t, s.get(fromDE, http.StatusOK, forward))
 	wantAbuseIPDBChecks(t, server, 0)
@@ -996,10 +1006,10 @@ func TestBanNotesNameEachReputationSourceThatListedTheClient(t *testing.T) {
 	}{
 		{"for a broken rate limit", func(s *sender, from string) {
 			s.get(from, http.StatusOK, requestlog.ActionForward)
-			s.get(from, http.StatusForbidden, requestlog.ActionRateLimited)
+			s.get(from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 		}},
 		{"for a clear sign of attack", func(s *sender, from string) {
-			s.request(from, probePath, http.StatusForbidden, requestlog.ActionBanned)
+			s.request(from, probePath, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 		}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {

internal/discriminator/request.go

@@ -48,16 +48,16 @@ type decision struct {
 	// so that not waiting never lowers its client's limits.
 	skippedLookupWait bool
 	// counted is true for a request the rate limits counted, whose bytes
-	// the byte limits count once it has ended. limitPercent and
+	// the byte limits count once it has ended. rateLimitPercent and
-	// bytesPercent are then its client's limit percentages for the rate
+	// bytesLimitPercent are then its client's limit percentages for the rate
 	// limits and for the byte limits.
 	counted                             bool
-	limitPercent, bytesPercent percentage
+	rateLimitPercent, bytesLimitPercent percentage
 	// attack is true for a request that matched a ban rule or asked for a
-	// trap path, ruleBlocked for one a block rule refused, and wafBlocked for
+	// trap path, blockedByBlockRule for one a block rule refused, and
-	// one the Core Rule Set refused, each an offence its client's history
+	// blockedByCoreRuleSet for one the Core Rule Set refused, each an offence
-	// counts.
+	// its client's history counts.
-	attack, ruleBlocked, wafBlocked bool
+	attack, blockedByBlockRule, blockedByCoreRuleSet bool
 	// reputation is the reputation sources that list the client, for the
 	// notes of a ban the request makes.
 	reputation []bans.ReputationHit
@@ -187,9 +187,10 @@ func (rq *request) check(ctx context.Context) *refusal {
 		rq.line.WouldAction = action
 
 		return nil
-	case action == requestlog.ActionRuleBlocked || action == requestlog.ActionWAFBlocked:
+	case action == requestlog.ActionBlockedByBlockRule ||
+		action == requestlog.ActionBlockedByCoreRuleSet:
 		return &refusal{status: http.StatusForbidden, action: action}
-	case action == requestlog.ActionTooLarge:
+	case action == requestlog.ActionRequestHeaderTooLarge:
 		return &refusal{status: http.StatusRequestHeaderFieldsTooLarge, action: action}
 	default:
 		return rq.banResponse(action)
@@ -261,8 +262,8 @@ func (rq *request) finish() {
 	}
 
 	duration := time.Since(rq.start)
-	line.DurationTotal = requestlog.Milliseconds(duration)
+	line.DurationTotalMS = requestlog.Milliseconds(duration)
-	line.DurationChecks = timing(rq.start, rq.checked)
+	line.DurationChecksMS = timing(rq.start, rq.checked)
 
 	// Counted before the log line is written, so that the metrics count
 	// every request whose line is out. An allowed request is the exception:
@@ -310,8 +311,8 @@ func (rq *request) addToHistory() {
 		ResponseBytes:        rq.out.bytes,
 		BrokeLimit:           rq.line.Offence == requestlog.OffenceLimit,
 		Attack:               rq.attack,
-		RuleBlocked:   rq.ruleBlocked,
+		BlockedByBlockRule:   rq.blockedByBlockRule,
-		WAFBlocked:    rq.wafBlocked,
+		BlockedByCoreRuleSet: rq.blockedByCoreRuleSet,
 	}
 
 	rq.h.limiter.AddToHistory(rq.h.clientGroup(rq.client), rq.h.now(), request)

internal/discriminator/requestlog_test.go

@@ -156,9 +156,9 @@ func wantBareLine(t *testing.T, line logLine) {
 
 // withTimings returns want with the timings of line.
 func withTimings(line logLine, want requestlog.Line) requestlog.Line {
-	want.DurationTotal = line.DurationTotal
+	want.DurationTotalMS = line.DurationTotalMS
-	want.DurationChecks = line.DurationChecks
+	want.DurationChecksMS = line.DurationChecksMS
-	want.DurationUpstreamTotal = line.DurationUpstreamTotal
+	want.DurationUpstreamTotalMS = line.DurationUpstreamTotalMS
 
 	return want
 }
@@ -226,10 +226,10 @@ func TestTimingsAreInOrder(t *testing.T) {
 
 	// A request passed to the app has every timing; one refused, none of
 	// the app's; the health check, which runs no check, only the total.
-	wantTimings(t, forwarded, "duration_total", "duration_checks",
+	wantTimings(t, forwarded, "duration_total_ms", "duration_checks_ms",
-		"duration_upstream_total")
+		"duration_upstream_total_ms")
-	wantTimings(t, refused, "duration_total", "duration_checks")
+	wantTimings(t, refused, "duration_total_ms", "duration_checks_ms")
-	wantTimings(t, health, "duration_total")
+	wantTimings(t, health, "duration_total_ms")
 
 	if t.Failed() {
 		return
@@ -237,9 +237,9 @@ func TestTimingsAreInOrder(t *testing.T) {
 
 	// In whole microseconds, as they are logged, so that the sum below is
 	// exact.
-	total := microseconds(forwarded.DurationTotal)
+	total := microseconds(forwarded.DurationTotalMS)
-	checks := microseconds(*forwarded.DurationChecks)
+	checks := microseconds(*forwarded.DurationChecksMS)
-	upstream := microseconds(*forwarded.DurationUpstreamTotal)
+	upstream := microseconds(*forwarded.DurationUpstreamTotalMS)
 
 	// The checks end before the request is handed to the app.
 	if checks+upstream > total {
@@ -247,9 +247,9 @@ func TestTimingsAreInOrder(t *testing.T) {
 			total, checks, upstream)
 	}
 
-	if *refused.DurationChecks > refused.DurationTotal {
+	if *refused.DurationChecksMS > refused.DurationTotalMS {
 		t.Errorf("refused request's checks took %v of %v milliseconds",
-			*refused.DurationChecks, refused.DurationTotal)
+			*refused.DurationChecksMS, refused.DurationTotalMS)
 	}
 }
 

internal/discriminator/routewatchtags.go

@@ -0,0 +1,42 @@
+package discriminator
+
+// The heuristic routewatch_tags. It reads SWW_ROUTEWATCH_URL.
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/config"
+)
+
+// routeWatchTags adds to the request the tags asn=<number> and prefix=<netblock>
+// from what routewatch answered about the client. It refuses nothing, and the
+// request does not wait for routewatch. A request that gets no tags from it has
+// the reason in the log line's routewatch_tags_missing. While SWW_ROUTEWATCH_URL
+// is unset it does nothing. Answers are kept by client and asked for by the
+// request's address, and a route without an origin AS gives only the prefix= tag.
+type routeWatchTags struct{}
+
+func (routeWatchTags) name() string { return "routewatch_tags" }
+
+func (routeWatchTags) check(ctx context.Context, rq *request, _ time.Time) *verdict {
+	if rq.h.routeWatch == nil {
+		return nil
+	}
+
+	route, missing := rq.h.routeWatch.Route(ctx, rq.h.clientGroup(rq.client), rq.client)
+	if missing != "" {
+		rq.line.RouteWatchTagsMissing = string(missing)
+
+		return nil
+	}
+
+	rq.addTag(config.PrefixTagPrefix + route.Netblock.String())
+
+	if route.ASN != 0 {
+		rq.addTag(config.ASNTagPrefix + strconv.FormatUint(uint64(route.ASN), 10))
+	}
+
+	return nil
+}

internal/discriminator/routewatchtags_test.go

@@ -0,0 +1,245 @@
+package discriminator_test
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/discriminator"
+	"sneak.berlin/go/smallwebwaf/internal/requestlog"
+)
+
+// routeWatchURL is SWW_ROUTEWATCH_URL, and tagsMissing the log line's field
+// that says why a request got no tags from routewatch.
+const (
+	routeWatchURL = "SWW_ROUTEWATCH_URL"
+	tagsMissing   = "routewatch_tags_missing"
+	fromV6        = "2001:db8:1::5"
+	prefixV6      = "2001:db8::/32"
+	prefixDE      = "203.0.113.0/24"
+	prefixKP      = "198.51.100.0/24"
+)
+
+// standInRoute is what the stand-in for routewatch answers about an address.
+type standInRoute struct {
+	Netblock string `json:"netblock"`
+	ASN      int    `json:"asn"`
+}
+
+// startRouteWatch starts a stand-in for routewatch's IP info API that knows the
+// routes given by address, and returns its URL.
+func startRouteWatch(t *testing.T, routes map[string]standInRoute) string {
+	t.Helper()
+
+	server := httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			address := strings.TrimPrefix(r.URL.Path, "/api/v1/ip/")
+
+			result := map[string]any{"ip": address}
+			if route, known := routes[address]; known {
+				result["netblock"], result["asn"] = route.Netblock, route.ASN
+			}
+
+			_ = json.NewEncoder(w).Encode(map[string]any{
+				"status": "ok",
+				"data":   map[string]any{"results": []any{result}},
+			})
+		}))
+	t.Cleanup(server.Close)
+
+	return server.URL
+}
+
+// waitForRouteWatch waits until routewatch's answer about from, in the client
+// group of the given length, is kept, so that the next request gets its tags.
+func waitForRouteWatch(
+	t *testing.T, server *discriminator.Server, from string, bits int,
+) {
+	t.Helper()
+
+	addr := netip.MustParseAddr(from)
+	client := netip.PrefixFrom(addr, bits).Masked()
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		_, missing := server.RouteWatch.Route(context.Background(), client, addr)
+		if missing == "" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("routewatch's answer about %s not kept: %q", from, missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func wantTagsMissing(t *testing.T, line logLine, want string) {
+	t.Helper()
+
+	got, _ := line.fields[tagsMissing].(string)
+	if got != want {
+		t.Errorf("log line has %s %q, want %q", tagsMissing, got, want)
+	}
+}
+
+func TestRouteWatchTagsAreOnTheLogLineWithTheLookupsTags(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromDE: {prefixDE, 64496}})
+	s, server, _ := startWithLookups(t, map[string]string{routeWatchURL: url})
+
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	wantTags(t, line, "asn=64496", "country=DE", "prefix="+prefixDE)
+	wantTagsMissing(t, line, "")
+}
+
+func TestRouteWatchTagsAreOnALineDenyNetsRefused(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromKP: {prefixKP, 64511}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, denyNets: fromKP,
+	})
+
+	waitForRouteWatch(t, server, fromKP, 32)
+
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied)
+	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+fromKP+`/32"}`)
+	wantTags(t, line, "asn=64511", "prefix="+prefixKP)
+}
+
+func TestRouteWithoutAnOriginASGivesOnlyThePrefixTag(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromDE: {prefixDE, 0}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url,
+	})
+
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	wantTags(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		"prefix="+prefixDE)
+}
+
+func TestUnsetRouteWatchChangesNothing(t *testing.T) {
+	t.Parallel()
+
+	s, _, server := startWithClock(t, "", map[string]string{lookupSource: off})
+
+	if server.RouteWatch != nil {
+		t.Error("RouteWatch is set while SWW_ROUTEWATCH_URL is unset")
+	}
+
+	line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+	if _, present := line.fields[tagsMissing]; present {
+		t.Errorf("log line has %s", tagsMissing)
+	}
+
+	if _, present := line.fields["tags"]; present {
+		t.Errorf("log line has tags %v", line.fields["tags"])
+	}
+}
+
+func TestUnreachableRouteWatchLetsTheRequestThroughAndSaysWhy(t *testing.T) {
+	t.Parallel()
+
+	// A stand-in that is closed at once, so that the port refuses connections.
+	dead := httptest.NewServer(http.NotFoundHandler())
+	url := dead.URL
+
+	dead.Close()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url,
+	})
+
+	wantTagsMissing(t, s.get(fromDE, http.StatusOK, requestlog.ActionForward),
+		"no_answer_yet")
+
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+
+		missing, _ := line.fields[tagsMissing].(string)
+		if missing == "request_failed" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("still %q, want request_failed", missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestAddressWithoutARouteHasNoTagsAndTheLineSaysSo(t *testing.T) {
+	t.Parallel()
+
+	s, _, _ := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: startRouteWatch(t, nil),
+	})
+
+	deadline := time.Now().Add(5 * time.Second)
+
+	for {
+		line := s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+
+		missing, _ := line.fields[tagsMissing].(string)
+		if missing == "no_route" {
+			return
+		}
+
+		if time.Now().After(deadline) {
+			t.Fatalf("still %q, want no_route", missing)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestTagDenyRefusesOnARouteWatchPrefix(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{
+		fromDE: {prefixDE, 64496}, fromKP: {prefixKP, 64511},
+	})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, tagDeny: "prefix=" + prefixKP,
+	})
+
+	waitForRouteWatch(t, server, fromKP, 32)
+	waitForRouteWatch(t, server, fromDE, 32)
+
+	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied),
+		"tag_deny", `{"tag": "prefix=`+prefixKP+`"}`)
+	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
+}
+
+func TestTagLimitPercentWorksWithAnIPv6Prefix(t *testing.T) {
+	t.Parallel()
+
+	url := startRouteWatch(t, map[string]standInRoute{fromV6: {prefixV6, 64496}})
+	s, _, server := startWithClock(t, "", map[string]string{
+		lookupSource: off, routeWatchURL: url, rateLimitPerMinute: "2",
+		tagLimitPercent: "prefix=" + prefixV6 + ":50",
+	})
+
+	waitForRouteWatch(t, server, fromV6, 64)
+
+	// Half of two is one: the second request breaks the limit.
+	line := s.get(fromV6, http.StatusOK, requestlog.ActionForward)
+	wantTags(t, line, "asn=64496", "prefix="+prefixV6)
+	s.get(fromV6, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
+}

internal/discriminator/rulefiles.go

@@ -16,9 +16,10 @@ import (
 // ruleFiles checks the request against the rules of the rule files at now,
 // notes the ids of those it matches in the log line, adds the tag
 // exploitsignature when it matches any, and refuses the request
-// when the last rule it matches refuses it: with ActionRuleBlocked for a block
+// when the last rule it matches refuses it: with ActionBlockedByBlockRule for a
-// rule, and ActionBanned for a ban rule. A ban rule bans the client's netblock
+// block rule, and for a ban rule with the action for the ban it makes. A ban
-// for a clear sign of attack, or in observe mode raises the alert for the ban
+// rule bans the client's netblock for a clear sign of attack, or in observe
+// mode raises the alert for the ban
 // it would have made. Either rule's match is noted as an offence, for the
 // client's history. Its figures are the rule's id and action.
 type ruleFiles struct{}
@@ -45,14 +46,16 @@ func (ruleFiles) check(_ context.Context, rq *request, now time.Time) *verdict {
 
 	switch last.Action {
 	case rules.ActionBlock:
-		rq.ruleBlocked = true
+		rq.blockedByBlockRule = true
 
-		return &verdict{action: requestlog.ActionRuleBlocked, figures: figures}
+		return &verdict{action: requestlog.ActionBlockedByBlockRule, figures: figures}
 	case rules.ActionBan:
 		rq.attack = true
-		rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target})
 
-		return &verdict{action: requestlog.ActionBanned, figures: figures}
+		return &verdict{
+			action:  rq.banForAttack(now, bans.Notes{RuleID: last.ID, Target: last.Target}),
+			figures: figures,
+		}
 	default:
 		return nil
 	}

internal/discriminator/rulefiles_test.go

@@ -37,13 +37,14 @@ func TestEachRuleAction(t *testing.T) {
 	// A block rule refuses with 403, whatever SWW_BAN_RESPONSE is, and
 	// bans no one.
 	line = s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
 	wantRuleIDs(t, line, "noted", "blocked")
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
 	// A ban rule refuses with SWW_BAN_RESPONSE, and bans the client for
 	// seven days, the default.
-	line = s.request(client, "/.env", http.StatusTooManyRequests, requestlog.ActionBanned)
+	line = s.request(client, "/.env", http.StatusTooManyRequests,
+		requestlog.ActionTemporarilyBanned)
 	wantRuleIDs(t, line, "noted", "probe")
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
@@ -82,7 +83,7 @@ func TestEachRuleAction(t *testing.T) {
 	// against the rules, and makes the ban permanent.
 	clk.advance(time.Hour)
 
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != permanent {
@@ -90,7 +91,7 @@ func TestEachRuleAction(t *testing.T) {
 	}
 
 	clk.advance(365 * 24 * time.Hour)
-	s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+	s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
 }
 
 func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
@@ -103,7 +104,7 @@ func TestEachRuleActionAddsTheExploitSignatureTag(t *testing.T) {
 	wantTags(t, s.request(client, "/noted", http.StatusOK, requestlog.ActionForward),
 		"exploitsignature")
 	wantTags(t, s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionRuleBlocked), "exploitsignature")
+		requestlog.ActionBlockedByBlockRule), "exploitsignature")
 	wantTags(t, s.get(client, http.StatusOK, requestlog.ActionForward))
 }
 
@@ -115,10 +116,11 @@ func TestRuleRefusalNamesItsHeuristicAndTheRule(t *testing.T) {
 	})
 
 	line := s.request(client, "/blocked", http.StatusForbidden,
-		requestlog.ActionRuleBlocked)
+		requestlog.ActionBlockedByBlockRule)
 	wantHeuristic(t, line, "rule_files", `{"rule_id": "blocked", "rule_action": "block"}`)
 
-	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	line = s.request(client, "/.env", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 	wantHeuristic(t, line, "rule_files", `{"rule_id": "probe", "rule_action": "ban"}`)
 }
 
@@ -131,7 +133,8 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	})
 
 	// The first probe bans for SWW_ATTACK_BAN_DURATION.
-	line := s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	line := s.request(client, "/.env", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 	if line.BanExpires != requestlog.FormatTime(clk.Now().Add(time.Hour)) {
 		t.Errorf("log line has ban_expires %q, want an hour on", line.BanExpires)
 	}
@@ -141,7 +144,8 @@ func TestNextClearSignOfAttackAfterABanBansPermanently(t *testing.T) {
 	clk.advance(time.Hour)
 	s.get(client, http.StatusOK, requestlog.ActionForward)
 
-	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	line = s.request(client, "/.env", http.StatusForbidden,
+		requestlog.ActionPermanentlyBanned)
 	if line.BanExpires != permanent {
 		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
 	}
@@ -169,7 +173,8 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 	// A probe over the rate limit breaks the limit before any rule sees
 	// it.
 	s.get(client, http.StatusOK, requestlog.ActionForward)
-	line = s.request(client, "/.env", http.StatusForbidden, requestlog.ActionRateLimited)
+	line = s.request(client, "/.env", http.StatusForbidden,
+		requestlog.ActionClientIsRateLimited)
 	wantRuleIDs(t, line)
 
 	limitBan := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
@@ -179,7 +184,7 @@ func TestRulesComeAfterTheOtherChecks(t *testing.T) {
 
 	// A client the rate limits do not apply to is still checked.
 	s.get(exempt, http.StatusOK, requestlog.ActionForward)
-	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(exempt, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 }
 
 func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
@@ -191,11 +196,11 @@ func TestObserveModeLogsWhatTheRulesWouldDo(t *testing.T) {
 	})
 
 	line := s.request(client, "/blocked", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionRuleBlocked)
+	wantWouldAction(t, line, requestlog.ActionBlockedByBlockRule)
 	wantRuleIDs(t, line, "blocked")
 
 	line = s.request(client, "/.env", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 	wantRuleIDs(t, line, "probe")
 
 	if line.BanExpires != "" {
@@ -219,9 +224,10 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 		metricsToken: token,
 	})
 
-	s.request(client, "/blocked", http.StatusForbidden, requestlog.ActionRuleBlocked)
+	s.request(client, "/blocked", http.StatusForbidden,
-	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionBanned)
+		requestlog.ActionBlockedByBlockRule)
-	s.get(client, http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/.env", http.StatusForbidden, requestlog.ActionTemporarilyBanned)
+	s.get(client, http.StatusForbidden, requestlog.ActionPermanentlyBanned)
 
 	metrics := s.scrape()
 	wantMetric(t, metrics,
@@ -229,10 +235,10 @@ func TestMetricsCountRuleMatchesAndBansForAnAttack(t *testing.T) {
 	wantMetric(t, metrics,
 		`sww_rule_matches_total{action="ban",instance="app",rule_id="probe"}`, 1)
 	wantMetric(t, metrics, `sww_rules_loaded{instance="app"}`, 2)
-	wantMetric(t, metrics, `sww_requests_total{action="rule_blocked",`+
+	wantMetric(t, metrics, `sww_requests_total{action="blocked_by_block_rule",`+
 		`instance="app",status_class="4xx"}`, 1)
 	wantMetric(t, metrics,
-		`sww_offences_total{instance="app",kind="rule_blocked"}`, 1)
+		`sww_offences_total{instance="app",kind="blocked_by_block_rule"}`, 1)
 	wantMetric(t, metrics, `sww_offences_total{instance="app",kind="attack"}`, 1)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="attack",instance="app"}`, 1)
 	wantMetric(t, metrics, `sww_bans_made_total{cause="limit",instance="app"}`, 0)

internal/discriminator/staticlists_test.go

@@ -68,7 +68,7 @@ func TestRequestFromAllowNetsIsNotCounted(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 	})
 }
 
@@ -92,7 +92,7 @@ func TestDenyNetsRefuseBeforeTheLookup(t *testing.T) {
 	wantStatus(t, do(t, req), http.StatusForbidden)
 
 	line := out.endedLine(t)
-	wantLine(t, line, http.StatusForbidden, requestlog.ActionDenied)
+	wantLine(t, line, http.StatusForbidden, requestlog.ActionClientDenied)
 
 	if len(asked()) != 0 {
 		t.Errorf("GeoJS was asked about %v, want nothing", asked())
@@ -108,7 +108,7 @@ func TestDenyNetsRefusalNamesItsHeuristicAndNetblock(t *testing.T) {
 
 	s, _, _ := startWithClock(t, "", map[string]string{denyNets: clientsNet})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "deny_nets", `{"netblock": "`+clientsNet+`"}`)
 }
 
@@ -125,10 +125,10 @@ func TestRequestRefusedByDenyNetsIsNotCounted(t *testing.T) {
 	// listedAddr's refused requests are not counted, so the first request
 	// from unlistedAddr is within the limit of one a minute.
 	wantAnswers(t, addr, out, []sentRequest{
-		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
-		{listedAddr, http.StatusForbidden, requestlog.ActionDenied},
+		{listedAddr, http.StatusForbidden, requestlog.ActionClientDenied},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 	})
 }
 
@@ -152,8 +152,8 @@ func TestRateLimitExemptNetsAreNeitherCountedNorRefused(t *testing.T) {
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{listedAddr, http.StatusOK, requestlog.ActionForward},
 		{unlistedAddr, http.StatusOK, requestlog.ActionForward},
-		{unlistedAddr, http.StatusForbidden, requestlog.ActionRateLimited},
+		{unlistedAddr, http.StatusForbidden, requestlog.ActionClientIsRateLimited},
-		{fromKP, http.StatusForbidden, requestlog.ActionDenied},
+		{fromKP, http.StatusForbidden, requestlog.ActionClientDenied},
 	})
 }
 

internal/discriminator/tagdeny.go

@@ -20,7 +20,7 @@ func (tagDeny) check(_ context.Context, rq *request, _ time.Time) *verdict {
 	for _, tag := range rq.line.Tags {
 		if slices.Contains(rq.h.config.TagDeny, tag) {
 			return &verdict{
-				action:  requestlog.ActionDenied,
+				action:  requestlog.ActionClientDenied,
 				figures: map[string]any{"tag": tag},
 			}
 		}

internal/discriminator/tagdeny_test.go

@@ -14,7 +14,7 @@ func TestTagDenyRefusesALookupTagAndNamesTheTag(t *testing.T) {
 	// in capitals.
 	s, _, _ := startWithLookups(t, map[string]string{tagDeny: "Country=kp"})
 
-	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "country=KP"}`)
 	wantTags(t, line, "asn=64511", "country=KP")
 
@@ -26,7 +26,7 @@ func TestTagDenyRefusesAnASNTag(t *testing.T) {
 
 	s, _, _ := startWithLookups(t, map[string]string{tagDeny: "asn=64511"})
 
-	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied),
+	wantHeuristic(t, s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied),
 		"tag_deny", `{"tag": "asn=64511"}`)
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 }
@@ -41,7 +41,7 @@ func TestTagDenyRefusesAListTagBeforeTheRateLimitsCount(t *testing.T) {
 
 	// Each is refused for its tag: none is counted to break the limit of one.
 	for range 3 {
-		wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionDenied),
+		wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionClientDenied),
 			"tag_deny", `{"tag": "torexit"}`)
 	}
 }
@@ -58,7 +58,7 @@ func TestTagDenyRefusesAMixedCaseZoneByItsLowerCaseTag(t *testing.T) {
 	})
 	loadVerdicts(server, map[string][]string{fromDE: {mixedCaseZone}})
 
-	wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionDenied),
+	wantHeuristic(t, s.get(fromDE, http.StatusForbidden, requestlog.ActionClientDenied),
 		"tag_deny", `{"tag": "dnsbl=`+dnsblZone+`"}`)
 }
 
@@ -69,7 +69,7 @@ func TestTagDenyRefusesAnExploitSignatureOfARuleThatOnlyLogs(t *testing.T) {
 		rulesDir: writeRules(t, "noted path log ^/\n"), tagDeny: "exploitsignature",
 	})
 
-	line := s.get(client, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.get(client, http.StatusForbidden, requestlog.ActionClientDenied)
 	wantHeuristic(t, line, "tag_deny", `{"tag": "exploitsignature"}`)
 	wantTags(t, line, "exploitsignature")
 }
@@ -87,8 +87,9 @@ func TestTagLimitPercentLowersALimitTheLowestWinning(t *testing.T) {
 	// A quarter of 4 requests a minute: the second breaks the limit.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
 
-	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	line := s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+	wantPercent(t, "rate_limit_percent",
+		line.RateLimitPercent, line.RateLimitPercentSetting,
 		"25 from "+tagLimitPercent)
 }
 
@@ -108,7 +109,8 @@ func TestTagLimitPercentLowersAByteLimitByAListTag(t *testing.T) {
 		t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
 	}
 
-	wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+	wantPercent(t, "bytes_limit_percent",
+		line.BytesLimitPercent, line.BytesLimitPercentSetting,
 		"50 from "+tagLimitPercent)
 
 	// fromKP, which the list does not hold, has the whole limit.
@@ -117,5 +119,6 @@ func TestTagLimitPercentLowersAByteLimitByAListTag(t *testing.T) {
 		t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
 	}
 
-	wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+	wantPercent(t, "bytes_limit_percent",
+		line.BytesLimitPercent, line.BytesLimitPercentSetting, none)
 }

internal/discriminator/taglists_test.go

@@ -80,7 +80,7 @@ func TestTagListsTagARequestRefusedBeforeTheLookup(t *testing.T) {
 	})
 	loadLists(t, server, map[string][]string{vpnList: {fromDE, fromKP}})
 
-	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionDenied)
+	line := s.get(fromKP, http.StatusForbidden, requestlog.ActionClientDenied)
 	if line.Heuristic != "deny_nets" {
 		t.Errorf("log line has heuristic %q, want deny_nets", line.Heuristic)
 	}
@@ -89,9 +89,9 @@ func TestTagListsTagARequestRefusedBeforeTheLookup(t *testing.T) {
 
 	// The second request breaks the limit of one a minute, which bans the client.
 	s.get(fromDE, http.StatusOK, requestlog.ActionForward)
-	s.get(fromDE, http.StatusForbidden, requestlog.ActionRateLimited)
+	s.get(fromDE, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
 
-	line = s.get(fromDE, http.StatusForbidden, requestlog.ActionBanned)
+	line = s.get(fromDE, http.StatusForbidden, requestlog.ActionTemporarilyBanned)
 	if line.Heuristic != "active_ban" {
 		t.Errorf("log line has heuristic %q, want active_ban", line.Heuristic)
 	}

internal/discriminator/trappaths.go

@@ -8,7 +8,6 @@ import (
 	"time"
 
 	"sneak.berlin/go/smallwebwaf/internal/bans"
-	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 )
 
@@ -30,10 +29,9 @@ func (trapPaths) check(_ context.Context, rq *request, now time.Time) *verdict {
 	}
 
 	rq.attack = true
-	rq.banForAttack(now, bans.Notes{TrapPath: path})
 
 	return &verdict{
-		action:  requestlog.ActionBanned,
+		action:  rq.banForAttack(now, bans.Notes{TrapPath: path}),
 		figures: map[string]any{"path": path},
 	}
 }

internal/discriminator/trappaths_test.go

@@ -43,7 +43,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 
 	// The query is not part of the path.
 	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusTooManyRequests,
-		requestlog.ActionBanned)
+		requestlog.ActionTemporarilyBanned)
 	wantRuleIDs(t, line)
 
 	if line.BanExpires != requestlog.FormatTime(start.Add(7*24*time.Hour)) {
@@ -77,7 +77,7 @@ func TestTrapPathBansAsABanRuleDoes(t *testing.T) {
 	}
 
 	// The next request is refused under the ban, and makes it permanent.
-	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionBanned)
+	line = s.get(client, http.StatusTooManyRequests, requestlog.ActionPermanentlyBanned)
 	if line.BanExpires != permanent {
 		t.Errorf("log line has ban_expires %q, want permanent", line.BanExpires)
 	}
@@ -89,7 +89,7 @@ func TestTrapPathRefusalNamesItsHeuristicAndPath(t *testing.T) {
 	s, _, _ := startWithClock(t, "", map[string]string{trapPaths: trapPathList})
 
 	line := s.request(client, "/wp-login.php?redirect_to=x", http.StatusForbidden,
-		requestlog.ActionBanned)
+		requestlog.ActionTemporarilyBanned)
 	wantHeuristic(t, line, "trap_paths", `{"path": "/wp-login.php"}`)
 }
 
@@ -100,7 +100,8 @@ func TestTrapPathMatchesThePathDecodedOnce(t *testing.T) {
 
 	// %2577 decodes once to %77, not to w.
 	s.request(otherClient, "/%2577p-login.php", http.StatusOK, requestlog.ActionForward)
-	s.request(client, "/%77p-login.php", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/%77p-login.php", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 
 	// The ban's notes give the path as the client sent it.
 	got := server.Ledger.Bans(netip.MustParsePrefix(client + "/32"))
@@ -117,7 +118,8 @@ func TestTrapPathsNeedNoRuleFiles(t *testing.T) {
 		"SWW_RULES_ENABLED": "false",
 	})
 
-	s.request(client, "/xmlrpc.php", http.StatusForbidden, requestlog.ActionBanned)
+	s.request(client, "/xmlrpc.php", http.StatusForbidden,
+		requestlog.ActionTemporarilyBanned)
 }
 
 func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
@@ -129,7 +131,7 @@ func TestObserveModeLogsWhatATrapPathWouldDo(t *testing.T) {
 	})
 
 	line := s.request(client, "/xmlrpc.php", http.StatusOK, requestlog.ActionForward)
-	wantWouldAction(t, line, requestlog.ActionBanned)
+	wantWouldAction(t, line, requestlog.ActionTemporarilyBanned)
 
 	// No ban was made.
 	s.get(client, http.StatusOK, requestlog.ActionForward)

internal/lookup/lookup.go

@@ -198,7 +198,7 @@ func (g *GeoJS) LookUp(ctx context.Context, client netip.Prefix) Answer {
 
 	answer, found := g.kept(client)
 	if !found {
-		g.metrics.GeoJSUnanswered.Inc()
+		g.metrics.RequestsWithoutGeoJSAnswer.Inc()
 	}
 
 	w, waiting := g.waiting[client]
@@ -296,7 +296,7 @@ func (g *GeoJS) answerOrWait(
 	}
 
 	if w == nil {
-		g.metrics.GeoJSUnanswered.Inc()
+		g.metrics.RequestsWithoutGeoJSAnswer.Inc()
 
 		return Answer{}, nil // too many clients wait already
 	}
@@ -307,7 +307,7 @@ func (g *GeoJS) answerOrWait(
 	}
 
 	if w.late {
-		g.metrics.GeoJSUnanswered.Inc()
+		g.metrics.RequestsWithoutGeoJSAnswer.Inc()
 
 		return Answer{}, nil
 	}

internal/lookup/lookup_test.go

@@ -362,7 +362,7 @@ func TestWithoutWaitTheRequestGoesOnAtOnceAndTheAnswerIsGivenWhenItComes(
 		mu.Unlock()
 
 		wantCountry(t, g, client, germany)
-		wantUnanswered(t, m, 0)
+		wantRequestsWithoutGeoJSAnswer(t, m, 0)
 	})
 }
 
@@ -596,7 +596,7 @@ func TestClientsWithoutAnAnswerAreCounted(t *testing.T) {
 		// GeoJS fails, so the first client goes without an answer, and GeoJS
 		// is left alone for a second, which does not pass in this test.
 		wantCountry(t, g, clients(), "")
-		wantUnanswered(t, m, 1)
+		wantRequestsWithoutGeoJSAnswer(t, m, 1)
 
 		// Meanwhile each new client goes without one at once, while there is
 		// room for it among the 10,000 that may wait.
@@ -604,11 +604,11 @@ func TestClientsWithoutAnAnswerAreCounted(t *testing.T) {
 			wantCountry(t, g, clients(), "")
 		}
 
-		wantUnanswered(t, m, 10000)
+		wantRequestsWithoutGeoJSAnswer(t, m, 10000)
 
 		// One more, for which there is no room, goes without one too.
 		wantCountry(t, g, clients(), "")
-		wantUnanswered(t, m, 10001)
+		wantRequestsWithoutGeoJSAnswer(t, m, 10001)
 	})
 }
 
@@ -841,12 +841,12 @@ func wantAsked(t *testing.T, geojs *standIn, i int, want ...string) {
 	}
 }
 
-// wantUnanswered checks how many requests m counts as having gone without
+// wantRequestsWithoutGeoJSAnswer checks how many requests m counts as having
-// an answer from GeoJS.
+// gone without an answer from GeoJS.
-func wantUnanswered(t *testing.T, m *metrics.Metrics, want float64) {
+func wantRequestsWithoutGeoJSAnswer(t *testing.T, m *metrics.Metrics, want float64) {
 	t.Helper()
 
-	got := testutil.ToFloat64(m.GeoJSUnanswered)
+	got := testutil.ToFloat64(m.RequestsWithoutGeoJSAnswer)
 	if got != want {
 		t.Errorf("%v requests went without an answer, want %v", got, want)
 	}

internal/metrics/metrics.go

@@ -36,7 +36,7 @@ type Metrics struct {
 	upstreamDuration   prometheus.Histogram
 	rateLimitHits      *prometheus.CounterVec
 	offences           *prometheus.CounterVec
-	wafMatches       *prometheus.CounterVec
+	coreRuleSetMatches *prometheus.CounterVec
 	// ruleMatches are made by AddRules, and reputationHits by
 	// AddReputation.
 	ruleMatches    *prometheus.CounterVec
@@ -45,12 +45,12 @@ type Metrics struct {
 	asns           *busiest
 
 	// GeoJSRequests are the requests to GeoJS, and GeoJSFailures those
-	// that failed. GeoJSUnanswered are the requests that needed their
+	// that failed. RequestsWithoutGeoJSAnswer are the requests that needed
-	// client's answer, for a setting that acts on it, and went on without
+	// their client's answer, for a setting that acts on it, and went on
-	// it because GeoJS had not given it in time.
+	// without it because GeoJS had not given it in time.
 	GeoJSRequests              prometheus.Counter
 	GeoJSFailures              prometheus.Counter
-	GeoJSUnanswered prometheus.Counter
+	RequestsWithoutGeoJSAnswer prometheus.Counter
 
 	stateFileWrites        *prometheus.CounterVec
 	stateFileWriteFailures *prometheus.CounterVec
@@ -101,7 +101,7 @@ func New(topN int, instanceName string) *Metrics {
 			[]string{"window", "kind"}),
 		offences: counterVec("sww_offences_total",
 			"Offences, by kind.", []string{"kind"}),
-		wafMatches: counterVec("sww_waf_matches_total",
+		coreRuleSetMatches: counterVec("sww_core_rule_set_matches_total",
 			"Requests that matched a rule of the Core Rule Set, by SWW_WAF_MODE "+
 				"and the rule's id.", []string{"mode", "rule_id"}),
 		countries: newCountries(topN),
@@ -114,8 +114,8 @@ func New(topN int, instanceName string) *Metrics {
 			Name: "sww_geojs_failures_total",
 			Help: "Requests to GeoJS that failed.",
 		}),
-		GeoJSUnanswered: prometheus.NewCounter(prometheus.CounterOpts{
+		RequestsWithoutGeoJSAnswer: prometheus.NewCounter(prometheus.CounterOpts{
-			Name: "sww_geojs_unanswered_total",
+			Name: "sww_requests_without_geojs_answer_total",
 			Help: "Requests that needed their client's answer from GeoJS and " +
 				"went on without it, because GeoJS had not given it in time.",
 		}),
@@ -139,9 +139,9 @@ func New(topN int, instanceName string) *Metrics {
 		collectors.NewProcessCollector(collectors.ProcessCollectorOpts{}),
 		m.inFlight, m.requests, m.requestBytes, m.responseBytes,
 		m.requestDuration, m.upstreamDuration,
-		m.rateLimitHits, m.offences, m.wafMatches,
+		m.rateLimitHits, m.offences, m.coreRuleSetMatches,
 		m.countries, m.asns,
-		m.GeoJSRequests, m.GeoJSFailures, m.GeoJSUnanswered,
+		m.GeoJSRequests, m.GeoJSFailures, m.RequestsWithoutGeoJSAnswer,
 		m.stateFileWrites, m.stateFileWriteFailures,
 		m.stateFileLastWrite, m.stateFileSize,
 		m.stateFileEditsTakenIn, m.stateFileEditsSetAside,
@@ -232,7 +232,7 @@ func (m *Metrics) AddRemoteLog(remote *remotelog.Sender) {
 			return float64(remote.Dropped())
 		}),
 		prometheus.NewGaugeFunc(prometheus.GaugeOpts{
-			Name: "sww_remote_log_buffer_depth",
+			Name: "sww_remote_log_lines_waiting",
 			Help: "Log lines in the buffer, waiting to be sent.",
 		}, func() float64 {
 			return float64(remote.Depth())
@@ -355,11 +355,11 @@ func (m *Metrics) AddAlerts(queue *alerts.Queue) {
 				return float64(queue.Counts(name).Sent)
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
-				Name:        "sww_alerts_failed_total",
+				Name:        "sww_alert_send_failures_total",
 				Help:        "Requests to the destination that failed.",
 				ConstLabels: destination,
 			}, func() float64 {
-				return float64(queue.Counts(name).Failed)
+				return float64(queue.Counts(name).SendFailures)
 			}),
 			prometheus.NewCounterFunc(prometheus.CounterOpts{
 				Name: "sww_alerts_suppressed_total",
@@ -426,8 +426,8 @@ func (m *Metrics) Offences(r ratelimit.Request) {
 	for kind, committed := range map[string]bool{
 		"limit":                    r.BrokeLimit,
 		"attack":                   r.Attack,
-		"rule_blocked": r.RuleBlocked,
+		"blocked_by_block_rule":    r.BlockedByBlockRule,
-		"waf_blocked":  r.WAFBlocked,
+		"blocked_by_core_rule_set": r.BlockedByCoreRuleSet,
 	} {
 		if committed {
 			m.offences.WithLabelValues(kind).Inc()
@@ -441,10 +441,10 @@ func (m *Metrics) RuleMatched(id, action string) {
 	m.ruleMatches.WithLabelValues(id, action).Inc()
 }
 
-// WAFMatched counts a request that matched the Core Rule Set's rule id,
+// CoreRuleSetMatched counts a request that matched the Core Rule Set's rule id,
 // with SWW_WAF_MODE at mode.
-func (m *Metrics) WAFMatched(mode string, id int) {
+func (m *Metrics) CoreRuleSetMatched(mode string, id int) {
-	m.wafMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
+	m.coreRuleSetMatches.WithLabelValues(mode, strconv.Itoa(id)).Inc()
 }
 
 // StateFileWritten counts a write of the state file name, of size bytes,

internal/ratelimit/ratelimit.go

@@ -122,12 +122,13 @@ type Responses struct {
 type Offences struct {
 	// Limit is its requests that broke a rate limit, a byte limit or the
 	// error burst, Attack those that were a clear sign of attack, a match
-	// of a ban rule or a request for a trap path, RuleBlocked those a block
+	// of a ban rule or a request for a trap path, BlockedByBlockRule those a
-	// rule refused, and WAFBlocked those the Core Rule Set refused.
+	// block rule refused, and BlockedByCoreRuleSet those the Core Rule Set
+	// refused.
 	Limit                int64 `json:"limit"`
 	Attack               int64 `json:"attack"`
-	RuleBlocked int64 `json:"rule_blocked"`
+	BlockedByBlockRule   int64 `json:"blocked_by_block_rule"`
-	WAFBlocked  int64 `json:"waf_blocked"`
+	BlockedByCoreRuleSet int64 `json:"blocked_by_core_rule_set"`
 	// TokenRefused is what a clients.json written by an earlier version gives,
 	// which must still load. Nothing adds to it.
 	TokenRefused int64 `json:"token_refused,omitempty"`
@@ -147,12 +148,12 @@ type Request struct {
 	ResponseBytes int64
 	// BrokeLimit is true for a request that broke a rate limit, a byte
 	// limit or the error burst, Attack for one that matched a ban rule or
-	// asked for a trap path, RuleBlocked for one a block rule refused, and
+	// asked for a trap path, BlockedByBlockRule for one a block rule refused,
-	// WAFBlocked for one the Core Rule Set refused.
+	// and BlockedByCoreRuleSet for one the Core Rule Set refused.
 	BrokeLimit           bool
 	Attack               bool
-	RuleBlocked bool
+	BlockedByBlockRule   bool
-	WAFBlocked  bool
+	BlockedByCoreRuleSet bool
 }
 
 // New returns a Limiter for limits, with no client counted yet, whose
@@ -323,12 +324,12 @@ func (l *Limiter) AddToHistory(client netip.Prefix, now time.Time, r Request) {
 		h.Offences.Attack++
 	}
 
-	if r.RuleBlocked {
+	if r.BlockedByBlockRule {
-		h.Offences.RuleBlocked++
+		h.Offences.BlockedByBlockRule++
 	}
 
-	if r.WAFBlocked {
+	if r.BlockedByCoreRuleSet {
-		h.Offences.WAFBlocked++
+		h.Offences.BlockedByCoreRuleSet++
 	}
 }
 

internal/requestlog/requestlog.go

@@ -20,39 +20,44 @@ const (
 	// the app.
 	ActionForward = "forward"
 
-	// ActionTooLarge is a request over the header limits.
+	// ActionRequestHeaderTooLarge is a request over the header limits.
-	ActionTooLarge = "too_large"
+	ActionRequestHeaderTooLarge = "request_header_too_large"
 
-	// ActionRateLimited is a request refused because it took its client
+	// ActionClientIsRateLimited is a request refused because it took its
-	// over a rate limit, which bans the client.
+	// client over a rate limit, which bans the client.
-	ActionRateLimited = "rate_limited"
+	ActionClientIsRateLimited = "client_is_rate_limited"
 
-	// ActionBanned is a request refused because a ban covers its client,
+	// ActionTemporarilyBanned is a request refused because a ban that runs
-	// or because it matched a ban rule, asked for a trap path or the
+	// out covers its client, or because it matched a ban rule, asked for a
-	// CrowdSec decision list lists its client, each of which bans the
+	// trap path or the CrowdSec decision list lists its client, and so made
-	// client.
+	// such a ban.
-	ActionBanned = "banned"
+	ActionTemporarilyBanned = "temporarily_banned"
 
-	// ActionRuleBlocked is a request refused because it matched a block
+	// ActionPermanentlyBanned is a request refused because a ban that never
-	// rule.
+	// runs out covers its client, or because the request made such a ban or
-	ActionRuleBlocked = "rule_blocked"
+	// made its client's ban permanent.
+	ActionPermanentlyBanned = "permanently_banned"
 
-	// ActionWAFBlocked is a request refused because the Core Rule Set
+	// ActionBlockedByBlockRule is a request refused because it matched a
-	// scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	// block rule.
-	ActionWAFBlocked = "waf_blocked"
+	ActionBlockedByBlockRule = "blocked_by_block_rule"
 
-	// ActionDenied is a request refused because its client is in
+	// ActionBlockedByCoreRuleSet is a request refused because the Core Rule
+	// Set scored it at or over SWW_WAF_ANOMALY_THRESHOLD.
+	ActionBlockedByCoreRuleSet = "blocked_by_core_rule_set"
+
+	// ActionClientDenied is a request refused because its client is in
 	// SWW_DENY_NETS, in a blocklist while SWW_BLOCKLIST_ACTION is deny,
 	// or listed by a DNSBL zone, or scored a hit by AbuseIPDB, while
 	// SWW_REPUTATION_ACTION is deny, or that carries a tag in SWW_TAG_DENY.
-	ActionDenied = "denied"
+	ActionClientDenied = "client_denied"
 
 	// ActionCountryDenied is a request refused because its client's country
 	// is not in SWW_EXCLUSIVELY_ALLOWED_COUNTRIES.
 	ActionCountryDenied = "country_denied"
-	// ActionAdmin is a request discriminator answered at one of its own
+	// ActionOwnEndpoint is a request discriminator answered at one of its own
 	// endpoints, or a question about a path under /_sww/.
-	ActionAdmin = "admin"
+	ActionOwnEndpoint = "own_endpoint"
 )
 
 // OffenceLimit is the offence a request line names for a request that
@@ -60,9 +65,9 @@ const (
 // limit.
 const OffenceLimit = "limit"
 
-// LimitHitErrorBurst is the limit_hit a request line names for a request
+// LimitHitMinuteRefusals is the limit_hit a request line names for a request
 // that broke the error burst.
-const LimitHitErrorBurst = "error_burst"
+const LimitHitMinuteRefusals = "minute_refusals"
 
 // The discriminator_line a request line names, which says which of
 // discriminator's two lines about a question it is.
@@ -134,10 +139,11 @@ type Line struct {
 	// The decision.
 	Action string `json:"action"`
 	// WouldAction is, in observe mode, the action enforce mode would have
-	// taken with a request it would have refused: ActionDenied,
+	// taken with a request it would have refused: ActionClientDenied,
-	// ActionBanned, ActionCountryDenied, ActionRateLimited,
+	// ActionTemporarilyBanned, ActionPermanentlyBanned, ActionCountryDenied,
-	// ActionRuleBlocked, ActionWAFBlocked, or, in discriminator, ActionTooLarge
+	// ActionClientIsRateLimited, ActionBlockedByBlockRule,
-	// for the header limits.
+	// ActionBlockedByCoreRuleSet, or, in discriminator,
+	// ActionRequestHeaderTooLarge for the header limits.
 	WouldAction string `json:"would_action,omitempty"`
 	// Heuristic is the name of the heuristic that refused the request, in
 	// observe mode too, and HeuristicFigures are the figures it acted on, by
@@ -149,15 +155,15 @@ type Line struct {
 	// request.
 	AfterAnswerHeuristic        string         `json:"after_answer_heuristic,omitempty"`
 	AfterAnswerHeuristicFigures map[string]any `json:"after_answer_heuristic_figures,omitempty"` //nolint:lll // a struct tag cannot be split
-	// LimitPercent and LimitPercentSetting are, for a request the rate
+	// RateLimitPercent and RateLimitPercentSetting are, for a request the
-	// limits counted whose client a biased threshold gives a percentage of
+	// rate limits counted whose client a biased threshold gives a percentage
-	// the rate limits below 100, that percentage and the setting that gave
+	// of the rate limits below 100, that percentage and the setting that gave
-	// it. BytesPercent and BytesPercentSetting are the same for the byte
+	// it. BytesLimitPercent and BytesLimitPercentSetting are the same for the
-	// limits.
+	// byte limits.
-	LimitPercent        *int64 `json:"limit_percent,omitempty"`
+	RateLimitPercent         *int64 `json:"rate_limit_percent,omitempty"`
-	LimitPercentSetting string `json:"limit_percent_setting,omitempty"`
+	RateLimitPercentSetting  string `json:"rate_limit_percent_setting,omitempty"`
-	BytesPercent        *int64 `json:"bytes_percent,omitempty"`
+	BytesLimitPercent        *int64 `json:"bytes_limit_percent,omitempty"`
-	BytesPercentSetting string `json:"bytes_percent_setting,omitempty"`
+	BytesLimitPercentSetting string `json:"bytes_limit_percent_setting,omitempty"`
 	// Counts are, for a request the rate limits counted, the client's
 	// requests as they counted them with this one, and its bytes as the
 	// byte limits counted them, with this request's once it has ended if
@@ -165,15 +171,15 @@ type Line struct {
 	Counts ratelimit.Counts `json:"counts,omitzero"`
 	// RuleIDs are the ids of the rule file rules the request matched.
 	RuleIDs []string `json:"rule_ids,omitempty"`
-	// WAFRuleIDs are the ids of the Core Rule Set's rules the request
+	// CoreRuleSetRuleIDs are the ids of the Core Rule Set's rules the request
-	// matched, and WAFScore its anomaly score, nil for a request the Core
+	// matched, and CoreRuleSetScore its anomaly score, nil for a request the
-	// Rule Set did not inspect.
+	// Core Rule Set did not inspect.
-	WAFRuleIDs []int `json:"waf_rule_ids,omitempty"`
+	CoreRuleSetRuleIDs []int `json:"core_rule_set_rule_ids,omitempty"`
-	WAFScore   *int  `json:"waf_score,omitempty"`
+	CoreRuleSetScore   *int  `json:"core_rule_set_score,omitempty"`
 	// LimitHit is the window whose limit the request went over, named as
 	// Counts names its count: minute, hour or day for a rate limit, and
 	// minute_bytes, hour_bytes or day_bytes for a byte limit; or
-	// LimitHitErrorBurst for the error burst.
+	// LimitHitMinuteRefusals for the error burst.
 	LimitHit string `json:"limit_hit,omitempty"`
 	// Reputation are the URLs of the blocklists that list the client, then
 	// that of the CrowdSec decision list when it does, then the DNSBL zones
@@ -182,21 +188,25 @@ type Line struct {
 	Reputation []string `json:"reputation,omitempty"`
 	// Tags are the request's tags, sorted.
 	Tags []string `json:"tags,omitempty"`
+	// RouteWatchTagsMissing, while SWW_ROUTEWATCH_URL is set, says why the
+	// request got no tags from routewatch: no_answer_yet, request_failed or
+	// no_route.
+	RouteWatchTagsMissing string `json:"routewatch_tags_missing,omitempty"`
 	// Offence is the offence the request was held as, OffenceLimit.
 	Offence string `json:"offence,omitempty"`
 	// BanExpires is when the ban the request made, or was refused under,
 	// ends: a time, or "permanent".
 	BanExpires string `json:"ban_expires,omitempty"`
 
-	// The timings, in milliseconds. DurationChecks is the time until the
+	// The timings. DurationChecksMS is the time until the checks were done, and
-	// checks were done, and DurationWAF the part of it the Core Rule Set
+	// DurationCoreRuleSetMS the part of it the Core Rule Set took.
-	// took. DurationUpstreamTotal is what the report of an allowed request gives,
+	// DurationUpstreamTotalMS is what the report of an allowed request gives,
 	// from the hand-over to the app until the end of its answer. Each but
-	// DurationTotal is nil for a request that did not get that far.
+	// DurationTotalMS is nil for a request that did not get that far.
-	DurationTotal         float64  `json:"duration_total"`
+	DurationTotalMS         float64  `json:"duration_total_ms"`
-	DurationChecks        *float64 `json:"duration_checks,omitempty"`
+	DurationChecksMS        *float64 `json:"duration_checks_ms,omitempty"`
-	DurationWAF           *float64 `json:"duration_waf,omitempty"`
+	DurationCoreRuleSetMS   *float64 `json:"duration_core_rule_set_ms,omitempty"`
-	DurationUpstreamTotal *float64 `json:"duration_upstream_total,omitempty"`
+	DurationUpstreamTotalMS *float64 `json:"duration_upstream_total_ms,omitempty"`
 }
 
 // RProxyLine is rproxy's short line in the request log about one request. The
@@ -216,11 +226,11 @@ type RProxyLine struct {
 	Status        int    `json:"status"`
 	RequestBytes  int64  `json:"request_bytes"`
 	ResponseBytes int64  `json:"response_bytes"`
-	// DurationRequest runs in milliseconds from the request's headers being read
+	// DurationRequestMS runs from the request's headers being read until the app
-	// until the app has been sent the whole request, or the answer has started
+	// has been sent the whole request, or the answer has started if that is
-	// if that is sooner. DurationResponse runs from then until the answer ends.
+	// sooner. DurationResponseMS runs from then until the answer ends.
-	DurationRequest  float64 `json:"duration_request"`
+	DurationRequestMS  float64 `json:"duration_request_ms"`
-	DurationResponse float64 `json:"duration_response"`
+	DurationResponseMS float64 `json:"duration_response_ms"`
 	// Disposition is the valid disposition discriminator answered or, while
 	// DefaultDisposition is true, the value of SWRP_DEFAULT_DISPOSITION. It is ""
 	// when neither gave one.

internal/requestlog/requestlog_test.go

@@ -22,7 +22,7 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 		ClientIP:        "203.0.113.9",
 		Status:          200,
 		Action:          requestlog.ActionForward,
-		DurationTotal: requestlog.Milliseconds(1500 * time.Microsecond),
+		DurationTotalMS: requestlog.Milliseconds(1500 * time.Microsecond),
 	})
 	if err != nil {
 		t.Fatalf("write: %v", err)
@@ -43,7 +43,7 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 	want := map[string]any{
 		"type": "request", "time": "2026-10-03T12:00:00.000Z",
 		"client_ip": "203.0.113.9", "status": 200.0, "action": "forward",
-		"duration_total": 1.5,
+		"duration_total_ms": 1.5,
 	}
 	for name, value := range want {
 		if fields[name] != value {
@@ -55,9 +55,9 @@ func TestWriteWritesOneJSONLineMarkedRequest(t *testing.T) {
 		"forwarded_for", "content_type", "content_length", "request_headers",
 		"has_authorization", "has_cookie", "websocket", "response_content_type",
 		"upstream_status", "cache_control", "location", "aborted", "counts",
-		"limit_hit", "offence", "ban_expires", "duration_checks",
+		"limit_hit", "offence", "ban_expires", "duration_checks_ms",
 		"duration_upstream_connect", "duration_upstream_first_byte",
-		"duration_upstream_total",
+		"duration_upstream_total_ms",
 	}
 	for _, name := range unset {
 		_, present := fields[name]
@@ -82,7 +82,7 @@ func TestWriteRProxyLineWritesOneJSONLineWithOnlyItsFields(t *testing.T) {
 
 	const want = `{"type":"request","time":"","request_id":"an-id","client_ip":"",` +
 		`"host":"","method":"","path":"","query":"","status":0,"request_bytes":0,` +
-		`"response_bytes":0,"duration_request":0,"duration_response":0,` +
+		`"response_bytes":0,"duration_request_ms":0,"duration_response_ms":0,` +
 		`"disposition":"allow"}` + "\n"
 	if out.String() != want {
 		t.Errorf("wrote %s, want %s", out.String(), want)

internal/routewatch/routewatch.go

@@ -0,0 +1,243 @@
+// Package routewatch asks a routewatch instance about client addresses, in the
+// background, and keeps its answers in memory. A routewatch instance knows, for
+// an address, the netblock it is announced in and the AS that originates it.
+package routewatch
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/netip"
+	"net/url"
+	"sync"
+	"time"
+
+	"github.com/hashicorp/golang-lru/v2/simplelru"
+)
+
+const (
+	// answerKept is how long an answer is used after it came.
+	answerKept = time.Hour
+	// failureKept is how long routewatch is not asked again after a query
+	// fails, so that a dead routewatch is not asked on every request.
+	failureKept = time.Minute
+	// queryTimeout is how long one query may take. routewatch answers only
+	// after a reverse DNS lookup it allows 2 seconds, so this is longer.
+	queryTimeout = 5 * time.Second
+	// maxAnswers is how many answers are kept. Past it, the one that came
+	// longest ago is dropped.
+	maxAnswers = 100000
+	// maxQueries is how many queries may be under way at once. Past it, a
+	// client is not asked about until its next request, so that a swarm of
+	// new addresses cannot fill the memory.
+	maxQueries = 100
+	// maxAnswerBytes is the most of an answer that is read.
+	maxAnswerBytes = 64 << 10
+)
+
+// Missing is why Route gives no route. The request log's field
+// routewatch_tags_missing gives these values.
+type Missing string
+
+const (
+	// NoAnswerYet is a client routewatch has not answered about yet.
+	NoAnswerYet Missing = "no_answer_yet"
+	// RequestFailed is no answer because a recent query failed.
+	RequestFailed Missing = "request_failed"
+	// NoRoute is routewatch knowing no live route for the address.
+	NoRoute Missing = "no_route"
+)
+
+var (
+	errStatus      = errors.New("routewatch answered")
+	errNoResult    = errors.New("the answer holds no result")
+	errNotNetblock = errors.New("the answer's netblock is not a netblock")
+)
+
+// Route is what routewatch knows of an address: the netblock it is announced
+// in, and the AS that originates it.
+type Route struct {
+	Netblock netip.Prefix
+	ASN      uint32
+}
+
+// Params are what New needs.
+type Params struct {
+	// URL is where routewatch is (SWW_ROUTEWATCH_URL).
+	URL string
+	// Now tells the time, normally time.Now in UTC.
+	Now func() time.Time
+	// ProcessLog receives the query that fails, and why.
+	ProcessLog *slog.Logger
+}
+
+// Client asks a routewatch instance about clients, in the background, and keeps
+// its answers. It is safe for concurrent use.
+type Client struct {
+	params     Params
+	httpClient *http.Client
+
+	mu sync.Mutex
+	// answers are by client. Each is added as it comes and never moved up,
+	// so that the one that came longest ago is the first dropped.
+	answers *simplelru.LRU[netip.Prefix, answer]
+	// asking are the clients whose query is under way.
+	asking map[netip.Prefix]bool
+	// retryAt is when routewatch may be asked again after a query failed.
+	retryAt time.Time
+}
+
+// answer is one kept answer: the route, or why there is none, and when it came.
+type answer struct {
+	route   Route
+	missing Missing
+	came    time.Time
+}
+
+// New returns a Client with no answer yet.
+func New(params Params) *Client {
+	answers, err := simplelru.NewLRU[netip.Prefix, answer](maxAnswers, nil)
+	if err != nil {
+		panic(err) // NewLRU fails only for a size below one
+	}
+
+	return &Client{
+		params:     params,
+		httpClient: &http.Client{},
+		answers:    answers,
+		asking:     map[netip.Prefix]bool{},
+	}
+}
+
+// Route returns what routewatch answered about client, an IPv4 address or an
+// IPv6 group, or why it has no route. It never waits for a query. A client
+// without an answer is asked about in the background, by addr, the address its
+// request came from, unless its query is under way, a query failed less than
+// failureKept ago, or maxQueries are under way. ctx is the context of the
+// client's request, and a query goes on after the request ends.
+func (c *Client) Route(
+	ctx context.Context, client netip.Prefix, addr netip.Addr,
+) (Route, Missing) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	now := c.params.Now()
+
+	kept, found := c.answers.Peek(client)
+	if found && now.Sub(kept.came) < answerKept {
+		return kept.route, kept.missing
+	}
+
+	if now.Before(c.retryAt) {
+		return Route{}, RequestFailed
+	}
+
+	if !c.asking[client] && len(c.asking) < maxQueries {
+		c.asking[client] = true
+
+		go c.ask(context.WithoutCancel(ctx), client, addr)
+	}
+
+	return Route{}, NoAnswerYet
+}
+
+// ask asks routewatch about addr, keeps the answer as client's, and notes the
+// query as no longer under way. A query that fails gives no answer, and
+// routewatch is not asked again for failureKept. Only the first failure of
+// those under way is logged.
+func (c *Client) ask(ctx context.Context, client netip.Prefix, addr netip.Addr) {
+	route, missing, err := c.query(ctx, addr)
+	now := c.params.Now()
+
+	c.mu.Lock()
+
+	delete(c.asking, client)
+
+	firstFailure := err != nil && !now.Before(c.retryAt)
+
+	if err == nil {
+		c.answers.Add(client, answer{route: route, missing: missing, came: now})
+	} else {
+		c.retryAt = now.Add(failureKept)
+	}
+
+	c.mu.Unlock()
+
+	if firstFailure {
+		c.params.ProcessLog.Warn("asking routewatch failed", "error", err.Error())
+	}
+}
+
+// query asks routewatch's IP info API about addr. An answer other than 200, one
+// that cannot be read, and none within queryTimeout, fail. A result with no
+// netblock is an address without a live route.
+func (c *Client) query(ctx context.Context, addr netip.Addr) (Route, Missing, error) {
+	ctx, cancel := context.WithTimeout(ctx, queryTimeout)
+	defer cancel()
+
+	endpoint, err := url.JoinPath(c.params.URL, "api/v1/ip", addr.String())
+	if err != nil {
+		return Route{}, "", fmt.Errorf("make the URL: %w", err)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, http.NoBody)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("make the request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	res, err := c.httpClient.Do(req)
+	if err != nil {
+		// Do's error names the URL, which holds the client's address, which
+		// is not to be logged: only what went wrong is kept.
+		return Route{}, "", fmt.Errorf("ask routewatch: %w", errors.Unwrap(err))
+	}
+
+	defer func() {
+		_ = res.Body.Close()
+	}()
+
+	if res.StatusCode != http.StatusOK {
+		return Route{}, "", fmt.Errorf("%w %s", errStatus, res.Status)
+	}
+
+	return readAnswer(io.LimitReader(res.Body, maxAnswerBytes))
+}
+
+// readAnswer reads routewatch's answer about one address.
+func readAnswer(body io.Reader) (Route, Missing, error) {
+	var decoded struct {
+		Data struct {
+			Results []struct {
+				Netblock string `json:"netblock"`
+				ASN      uint32 `json:"asn"`
+			} `json:"results"`
+		} `json:"data"`
+	}
+
+	err := json.NewDecoder(body).Decode(&decoded)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("read the answer: %w", err)
+	}
+
+	if len(decoded.Data.Results) == 0 {
+		return Route{}, "", errNoResult
+	}
+
+	result := decoded.Data.Results[0]
+	if result.Netblock == "" {
+		return Route{}, NoRoute, nil
+	}
+
+	netblock, err := netip.ParsePrefix(result.Netblock)
+	if err != nil {
+		return Route{}, "", fmt.Errorf("%w: %q", errNotNetblock, result.Netblock)
+	}
+
+	return Route{Netblock: netblock.Masked(), ASN: result.ASN}, "", nil
+}

internal/routewatch/routewatch_test.go

@@ -0,0 +1,333 @@
+package routewatch_test
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"net/netip"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"sneak.berlin/go/smallwebwaf/internal/routewatch"
+)
+
+const (
+	clientAddr   = "192.0.2.1"
+	routedAnswer = `{"status":"ok","data":{"results":[` +
+		`{"ip":"192.0.2.1","netblock":"192.0.2.0/24","asn":64496}]}}`
+	noRouteAnswer = `{"status":"ok","data":{"results":[{"ip":"192.0.2.1"}]}}`
+	// slowAnswer is longer than routewatch allows a reverse DNS lookup.
+	slowAnswer = 2500 * time.Millisecond
+	// waitLimit is longer than the Client allows a query.
+	waitLimit = 10 * time.Second
+)
+
+// clock is a time the tests move by hand.
+type clock struct {
+	mu  sync.Mutex
+	now time.Time
+}
+
+func (c *clock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	return c.now
+}
+
+func (c *clock) advance(by time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.now = c.now.Add(by)
+}
+
+// fixture is a Client asking a stand-in for routewatch. queries counts what the
+// stand-in was asked, paths holds the last path it was asked for, and log holds
+// the process log.
+type fixture struct {
+	t       *testing.T
+	server  *httptest.Server
+	client  *routewatch.Client
+	clk     *clock
+	queries *atomic.Int32
+	path    *atomic.Value
+	log     *syncBuffer
+}
+
+// syncBuffer is a buffer the background queries can log to while a test reads it.
+type syncBuffer struct {
+	mu  sync.Mutex
+	buf bytes.Buffer
+}
+
+func (b *syncBuffer) Write(p []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.buf.Write(p)
+}
+
+func (b *syncBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	return b.buf.String()
+}
+
+func newFixture(t *testing.T, standIn http.HandlerFunc) *fixture {
+	t.Helper()
+
+	f := &fixture{
+		t:       t,
+		clk:     &clock{now: time.Date(2026, 11, 9, 0, 0, 0, 0, time.UTC)},
+		queries: &atomic.Int32{},
+		path:    &atomic.Value{},
+		log:     &syncBuffer{},
+	}
+
+	f.server = httptest.NewServer(http.HandlerFunc(
+		func(w http.ResponseWriter, r *http.Request) {
+			f.queries.Add(1)
+			f.path.Store(r.URL.Path)
+			standIn(w, r)
+		}))
+	t.Cleanup(f.server.Close)
+
+	f.client = routewatch.New(routewatch.Params{
+		URL: f.server.URL + "/", Now: f.clk.Now,
+		ProcessLog: slog.New(slog.NewTextHandler(f.log, nil)),
+	})
+
+	return f
+}
+
+func answering(body string) http.HandlerFunc {
+	return func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(body))
+	}
+}
+
+func (f *fixture) route() (routewatch.Route, routewatch.Missing) {
+	addr := netip.MustParseAddr(clientAddr)
+	client := netip.PrefixFrom(addr, addr.BitLen())
+
+	return f.client.Route(context.Background(), client, addr)
+}
+
+// waitFor asks until the answer is why, or, while why is "", until there is a
+// route, and returns the route.
+func (f *fixture) waitFor(why routewatch.Missing) routewatch.Route {
+	f.t.Helper()
+
+	deadline := time.Now().Add(waitLimit)
+
+	for {
+		route, missing := f.route()
+		if missing == why {
+			return route
+		}
+
+		if time.Now().After(deadline) {
+			f.t.Fatalf("still %q after %s, want %q", missing, waitLimit, why)
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+// wantFailureLoggedWithoutTheClient waits for the process log to name a failed
+// query, and checks that it does not name the client.
+func (f *fixture) wantFailureLoggedWithoutTheClient() {
+	f.t.Helper()
+
+	// The failure is noted before it is logged.
+	deadline := time.Now().Add(waitLimit)
+	for !strings.Contains(f.log.String(), "asking routewatch failed") {
+		if time.Now().After(deadline) {
+			f.t.Fatalf("process log %q names no failure", f.log.String())
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+
+	if strings.Contains(f.log.String(), clientAddr) {
+		f.t.Errorf("process log %q names the client", f.log.String())
+	}
+}
+
+func TestRouteGivesRoutewatchsAnswerAndAsksByAddress(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	if _, missing := f.route(); missing != routewatch.NoAnswerYet {
+		t.Errorf("before the answer: %q, want %q", missing, routewatch.NoAnswerYet)
+	}
+
+	route := f.waitFor("")
+
+	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	if route != want {
+		t.Errorf("route %+v, want %+v", route, want)
+	}
+
+	if got := f.path.Load(); got != "/api/v1/ip/"+clientAddr {
+		t.Errorf("asked for path %v", got)
+	}
+}
+
+func TestAnswerAfterASlowReverseDNSLookupIsKept(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		time.Sleep(slowAnswer)
+
+		_, _ = w.Write([]byte(routedAnswer))
+	})
+
+	f.route()
+
+	route := f.waitFor("")
+
+	want := routewatch.Route{Netblock: netip.MustParsePrefix("192.0.2.0/24"), ASN: 64496}
+	if route != want {
+		t.Errorf("route %+v, want %+v", route, want)
+	}
+}
+
+func TestAddressWithoutARouteIsKeptAsNoRoute(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(noRouteAnswer))
+
+	f.route()
+	f.waitFor(routewatch.NoRoute)
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries, want 1", got)
+	}
+}
+
+func TestAnswerRoutewatchCannotBeTakenFromFails(t *testing.T) {
+	t.Parallel()
+
+	tests := map[string]http.HandlerFunc{
+		"500": func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+		},
+		"not JSON":   answering("no"),
+		"no results": answering(`{"status":"ok","data":{"results":[]}}`),
+		"bad netblock": answering(
+			`{"status":"ok","data":{"results":[{"netblock":"nowhere","asn":1}]}}`),
+	}
+	for name, standIn := range tests {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			f := newFixture(t, standIn)
+
+			f.route()
+			f.waitFor(routewatch.RequestFailed)
+			f.wantFailureLoggedWithoutTheClient()
+		})
+	}
+}
+
+func TestRefusedConnectionFailsTheQueryAndTheLogOmitsTheClient(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, answering(routedAnswer))
+
+	f.server.Close()
+
+	f.route()
+	f.waitFor(routewatch.RequestFailed)
+	f.wantFailureLoggedWithoutTheClient()
+}
+
+func TestFailureIsKeptForAMinuteSoRoutewatchIsNotAskedPerRequest(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusInternalServerError)
+	})
+
+	f.route()
+	f.waitFor(routewatch.RequestFailed)
+	f.route()
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries while the failure is kept, want 1", got)
+	}
+
+	f.clk.advance(time.Minute)
+	f.route()
+
+	deadline := time.Now().Add(waitLimit)
+	for f.queries.Load() != 2 {
+		if time.Now().After(deadline) {
+			t.Fatalf("%d queries after the failure expired, want 2", f.queries.Load())
+		}
+
+		time.Sleep(time.Millisecond)
+	}
+}
+
+func TestHangingRoutewatchNeverDelaysAndFailsTheQuery(t *testing.T) {
+	t.Parallel()
+
+	f := newFixture(t, func(_ http.ResponseWriter, r *http.Request) {
+		<-r.Context().Done()
+	})
+
+	start := time.Now()
+
+	f.route()
+
+	if elapsed := time.Since(start); elapsed > time.Second {
+		t.Errorf("Route took %s while routewatch hangs", elapsed)
+	}
+
+	f.waitFor(routewatch.RequestFailed)
+	f.wantFailureLoggedWithoutTheClient()
+}
+
+func TestRepeatedRequestsMakeOneQueryAndTheAnswerExpires(t *testing.T) {
+	t.Parallel()
+
+	release := make(chan struct{})
+	f := newFixture(t, func(w http.ResponseWriter, _ *http.Request) {
+		<-release
+
+		_, _ = w.Write([]byte(routedAnswer))
+	})
+
+	for range 50 {
+		f.route()
+	}
+
+	close(release)
+	f.waitFor("")
+
+	for range 50 {
+		f.route()
+	}
+
+	if got := f.queries.Load(); got != 1 {
+		t.Errorf("%d queries for repeated requests, want 1", got)
+	}
+
+	f.clk.advance(time.Hour)
+	f.waitFor(routewatch.NoAnswerYet)
+	f.waitFor("")
+
+	if got := f.queries.Load(); got != 2 {
+		t.Errorf("%d queries after the answer expired, want 2", got)
+	}
+}

internal/rproxy/request.go

@@ -371,8 +371,8 @@ func (rq *request) finish(ctx context.Context) {
 		Status:             rq.out.status,
 		RequestBytes:       requestBytes,
 		ResponseBytes:      responseBytes,
-		DurationRequest:    requestlog.Milliseconds(requestEnd.Sub(rq.start)),
+		DurationRequestMS:  requestlog.Milliseconds(requestEnd.Sub(rq.start)),
-		DurationResponse:   requestlog.Milliseconds(end.Sub(requestEnd)),
+		DurationResponseMS: requestlog.Milliseconds(end.Sub(requestEnd)),
 		Disposition:        rq.disposition,
 		DefaultDisposition: rq.byDefault,
 	})
@@ -389,10 +389,10 @@ func (rq *request) finish(ctx context.Context) {
 		Status:          min(rq.out.status, reportStatusMax),
 		RequestBytes:    requestBytes,
 		ResponseBytes:   responseBytes,
-		DurationTotal: requestlog.Milliseconds(end.Sub(rq.start)),
+		DurationTotalMS: requestlog.Milliseconds(end.Sub(rq.start)),
 	}
 	if !rq.upstreamStart.IsZero() {
-		report.DurationUpstreamTotal = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
+		report.DurationUpstreamTotalMS = requestlog.Milliseconds(end.Sub(rq.upstreamStart))
 	}
 
 	rq.h.sendReport(ctx, report)

internal/rproxy/rproxy.go

@@ -45,9 +45,9 @@ const (
 	idleTimeout = 120 * time.Second
 )
 
-// adminPrefix starts the path of every request for sww itself, which
+// ownEndpointPrefix starts the path of every request for sww itself, which
 // never reaches the app.
-const adminPrefix = "/_sww/"
+const ownEndpointPrefix = "/_sww/"
 
 // allowedMethods lists the methods rproxy passes on, as an Allow header gives
 // them. It answers any other method 405 itself.
@@ -211,8 +211,8 @@ func (h *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 }
 
 // passToApp passes the request on to the app, unless a limit or its path keeps
-// it from the app. discriminator answers a path under adminPrefix itself, so such a
+// it from the app. discriminator answers a path under ownEndpointPrefix itself, so
-// request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
+// such a request gets here only when SWRP_DEFAULT_DISPOSITION allowed it. ctx is the
 // request's own context.
 func (rq *request) passToApp(ctx context.Context) {
 	maxBytes := rq.h.config.MaxRequestSize
@@ -220,7 +220,7 @@ func (rq *request) passToApp(ctx context.Context) {
 	switch {
 	case rq.refused.Load() != 0 || (maxBytes > 0 && rq.in.ContentLength > maxBytes):
 		rq.answer(http.StatusRequestEntityTooLarge)
-	case strings.HasPrefix(rq.in.URL.Path, adminPrefix):
+	case strings.HasPrefix(rq.in.URL.Path, ownEndpointPrefix):
 		rq.answer(http.StatusNotFound)
 	default:
 		rq.forward(ctx)

internal/rproxy/rproxy_test.go

@@ -727,7 +727,7 @@ func TestDenyGivesTheVisitorDiscriminatorsAnswer(t *testing.T) {
 	report := standIn.report(t)
 	if report.Status != http.StatusForbidden ||
 		report.ResponseBytes != int64(len(deniedBody)) ||
-		report.DurationUpstreamTotal != 0 {
+		report.DurationUpstreamTotalMS != 0 {
 		t.Errorf("report %+v, of a request denied", report)
 	}
 
@@ -871,9 +871,9 @@ func TestALineForARequestClosedWithoutAnAnswerHasNoNegativeTime(t *testing.T) {
 
 		line := out.requestLine(t)
 
-		duration, ok := line["duration_response"].(float64)
+		duration, ok := line["duration_response_ms"].(float64)
 		if !ok || duration < 0 {
-			t.Errorf("line %v, want a duration_response that is not negative", line)
+			t.Errorf("line %v, want a duration_response_ms that is not negative", line)
 		}
 	}
 }
@@ -1428,8 +1428,8 @@ func TestReportGivesWhatHappened(t *testing.T) {
 	if report.RequestID == "" || report.Status != http.StatusOK ||
 		report.RequestBytes != int64(len(body)) ||
 		report.ResponseBytes != int64(len(greeting)) ||
-		report.DurationTotal <= 0 || report.DurationUpstreamTotal <= 0 ||
+		report.DurationTotalMS <= 0 || report.DurationUpstreamTotalMS <= 0 ||
-		report.DurationUpstreamTotal > report.DurationTotal {
+		report.DurationUpstreamTotalMS > report.DurationTotalMS {
 		t.Errorf("report %+v, of %d bytes up and %d back", report, len(body), len(greeting))
 	}
 
@@ -1748,7 +1748,7 @@ func TestLogLineGivesTheRequestAsSent(t *testing.T) {
 		t.Errorf("default_disposition is %v, want it left out", line["default_disposition"])
 	}
 
-	for _, name := range []string{"duration_request", "duration_response"} {
+	for _, name := range []string{"duration_request_ms", "duration_response_ms"} {
 		duration, ok := line[name].(float64)
 		if !ok || duration <= 0 {
 			t.Errorf("%s is %v, want a time", name, line[name])

internal/state/state.go

@@ -64,7 +64,7 @@ var (
 	errCause       = errors.New("is not limit, attack, admin or crowdsec")
 	errExpires     = errors.New("is not after its start")
 	errDestination = errors.New("is not webhook, slack or ntfy")
-	errScope       = errors.New("is not client, net, asn, total or watch")
+	errScope       = errors.New("is not client, net, asn, total or watched_net")
 	errWaitingList = errors.New(`waiting is a list, but now lists the alerts by ` +
 		`destination: put the list under "webhook", as "waiting": {"webhook": [...]}, ` +
 		`or remove the file`)
@@ -858,8 +858,8 @@ func (f *alertsFile) check([]byte) error {
 }
 
 // checkAnomalyCounters refuses an anomaly counter whose scope is not
-// client, net, asn, total or watch, most likely misspelt, and one without
+// client, net, asn, total or watched_net, most likely misspelt, and one
-// a field it needs, as missingFromCounter tells.
+// without a field it needs, as missingFromCounter tells.
 func checkAnomalyCounters(counters []anomaly.Counter) error {
 	for i, counter := range counters {
 		if !slices.Contains(anomaly.Scopes(), counter.Scope) {
@@ -879,9 +879,9 @@ func checkAnomalyCounters(counters []anomaly.Counter) error {
 // missingFromCounter returns the first field counter, an anomaly counter,
 // needs and has not, or "" when it has them all: what tells it from the
 // others in its scope, without which it would never be counted again, the
-// netblock of a client, net or watch counter, the AS number of an asn one
+// netblock of a client, net or watched_net counter, the AS number of an
-// and the name of a watch one; and the start of a window in which it has
+// asn one and the name of a watched_net one; and the start of a window in
-// requests or bytes, without which they would be dropped.
+// which it has requests or bytes, without which they would be dropped.
 func missingFromCounter(counter anomaly.Counter) string {
 	scope := counter.Scope
 
@@ -891,7 +891,7 @@ func missingFromCounter(counter anomaly.Counter) string {
 		return "netblock"
 	case scope == anomaly.ScopeASN && counter.ASN == "":
 		return "asn"
-	case scope == anomaly.ScopeWatch && counter.Name == "":
+	case scope == anomaly.ScopeWatchedNet && counter.Name == "":
 		return "name"
 	case countsWithoutStart(counter.Minute):
 		return "minute.start"

internal/state/state_test.go

@@ -208,7 +208,7 @@ const filledAlertsJSON = `{
             }
         },
         {
-            "scope": "watch",
+            "scope": "watched_net",
             "netblock": "203.0.113.0/24",
             "name": "office",
             "hour": {
@@ -534,7 +534,7 @@ func TestFileThatDoesNotParseStopsTheStart(t *testing.T) {
 			`{"version": 1, "anomaly_counters": [{"scope": "total"}, ` +
 				`{"scope": "nett", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 2's scope "nett" is not client, net, asn, total ` +
-				`or watch`,
+				`or watched_net`,
 		},
 		{
 			"a copy of a list with a line that does not read", reputationJSON,
@@ -831,12 +831,12 @@ func TestAlertsJSONEntryWithoutAFieldItNeedsStopsTheStart(t *testing.T) {
 		{
 			"an anomaly counter of a named netblock without its name",
 			`{"version": 1, "anomaly_counters": [` +
-				`{"scope": "watch", "netblock": "203.0.113.0/24"}]}`,
+				`{"scope": "watched_net", "netblock": "203.0.113.0/24"}]}`,
 			`: anomaly_counters entry 1 has no "name"`,
 		},
 		{
 			"an anomaly counter of a named netblock without its netblock",
-			`{"version": 1, "anomaly_counters": [{"scope": "watch", "name": "office"}]}`,
+			`{"version": 1, "anomaly_counters": [{"scope": "watched_net", "name": "office"}]}`,
 			`: anomaly_counters entry 1 has no "netblock"`,
 		},
 		{
@@ -1729,7 +1729,7 @@ func newParams(dir string) state.Params {
 		Dir:             dir,
 		WriteDelay:      time.Hour,
 		CounterInterval: time.Hour,
-		Ledger: bans.New(bans.Rules{
+		Ledger: bans.New(bans.Params{
 			LimitBanDuration:     time.Hour,
 			LimitBanRepeatWindow: 24 * time.Hour,
 			MaxBanDuration:       7 * 24 * time.Hour,

internal/sww/sww.go

@@ -22,6 +22,7 @@ import (
 
 	"sneak.berlin/go/smallwebwaf/internal/alerts"
 	"sneak.berlin/go/smallwebwaf/internal/config"
+	"sneak.berlin/go/smallwebwaf/internal/coreruleset"
 	"sneak.berlin/go/smallwebwaf/internal/discriminator"
 	"sneak.berlin/go/smallwebwaf/internal/lookup"
 	"sneak.berlin/go/smallwebwaf/internal/remotelog"
@@ -29,7 +30,6 @@ import (
 	"sneak.berlin/go/smallwebwaf/internal/requestlog"
 	"sneak.berlin/go/smallwebwaf/internal/rules"
 	"sneak.berlin/go/smallwebwaf/internal/state"
-	"sneak.berlin/go/smallwebwaf/internal/waf"
 )
 
 // shutdownTimeout is how long requests in progress may take to finish
@@ -197,7 +197,7 @@ func RunDiscriminator(ctx context.Context, params Params) int {
 func newServer(
 	cfg *config.Config, stdout io.Writer, processLog *slog.Logger,
 	now func() time.Time, ruleFiles *rules.Files, alertQueue *alerts.Queue,
-	crs *waf.CoreRuleSet,
+	crs *coreruleset.CoreRuleSet,
 ) (*discriminator.Server, error) {
 	var lookupFile *lookup.File
 

internal/sww/sww_test.go

@@ -373,13 +373,13 @@ func TestStateKeptAcrossRestarts(t *testing.T) {
 	out := runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "rate_limited")
+	out.line(t, "action", "client_is_rate_limited")
 
 	// After another, the ban still refuses it.
 	out = runUntilStopped(t, env, func(url string) {
 		wantRefused(t, url)
 	})
-	out.line(t, "action", "banned")
+	out.line(t, "action", "temporarily_banned")
 }
 
 func TestBanRefusesItsNetblockAfterARestartWithAnotherScope(t *testing.T) {
@@ -526,7 +526,7 @@ func TestRuleFileAddedWhileRunningTakesEffect(t *testing.T) {
 			time.Sleep(pollInterval)
 		}
 	})
-	out.line(t, "action", "rule_blocked")
+	out.line(t, "action", "blocked_by_block_rule")
 }
 
 func TestRuleFileThatDoesNotParseStopsTheStart(t *testing.T) {
@@ -740,7 +740,7 @@ func TestBlocklistTriesAndCopiesKeptInReputationJSONAcrossRestarts(t *testing.T)
 			time.Sleep(pollInterval)
 		}
 	})
-	wantDeniedByList(t, out.line(t, "action", "denied"), dropURL)
+	wantDeniedByList(t, out.line(t, "action", "client_denied"), dropURL)
 
 	if fetches := torFetches.Load(); fetches != 1 {
 		t.Errorf("tor.txt fetched %d times, want once, before the restart", fetches)
@@ -843,7 +843,8 @@ func wantDeniedByList(t *testing.T, line map[string]any, listURL string) {
 	t.Helper()
 
 	reputation, _ := line["reputation"].([]any)
-	if line["action"] != "denied" || len(reputation) != 1 || reputation[0] != listURL {
+	if line["action"] != "client_denied" || len(reputation) != 1 ||
+		reputation[0] != listURL {
 		t.Errorf("request log line %v, want one denied for %s", line, listURL)
 	}
 }
@@ -961,7 +962,7 @@ func TestStalledRemoteLogEndpointHoldsUpNoRequest(t *testing.T) {
 		metrics := metricsText(t, url+"_sww/metrics", token)
 		for _, series := range []string{
 			`sww_remote_log_lines_sent_total{instance="fsn1app1/blog"} 0`,
-			`sww_remote_log_buffer_depth{instance="fsn1app1/blog"} 1`,
+			`sww_remote_log_lines_waiting{instance="fsn1app1/blog"} 1`,
 		} {
 			if !strings.Contains(metrics, "\n"+series+"\n") {
 				t.Errorf("no %q in the metrics:\n%s", series, metrics)
@@ -1067,8 +1068,12 @@ func TestBanIsAlertedAndAnAlertNotSentIsKeptAcrossARestart(t *testing.T) {
 		metrics := metricsWith(t, url+"_sww/metrics", token,
 			"\nsww_alerts_sent_total"+ofWebhook+" 1\n")
 
-		for _, series := range []string{"failed", "suppressed", "dropped"} {
+		for _, series := range []string{
-			zero := "\nsww_alerts_" + series + "_total" + ofWebhook + " 0\n"
+			"sww_alert_send_failures_total",
+			"sww_alerts_suppressed_total",
+			"sww_alerts_dropped_total",
+		} {
+			zero := "\n" + series + ofWebhook + " 0\n"
 			if !strings.Contains(metrics, zero) {
 				t.Errorf("no %q in the metrics:\n%s", zero, metrics)
 			}

script/example-app

@@ -187,15 +187,16 @@ main() {
     echo "example-app: rproxy passes a request to the app and its answer back"
 
     refused || fail "a second request in a minute was not refused"
-    wait_for "discriminator logged no ban" logged "$DISCRIMINATOR" '"action":"rate_limited"'
+    wait_for "discriminator logged no ban" \
+        logged "$DISCRIMINATOR" '"action":"client_is_rate_limited"'
     echo "example-app: a second request in a minute bans the client"
 
     refused_from 203.0.113.9 /.env || fail "a probe for /.env was not refused"
     wait_for "discriminator logged no ban for the probe" \
-        logged "$DISCRIMINATOR" '"action":"banned"' '"rule_ids":["env-file"]'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"' '"rule_ids":["env-file"]'
     refused_from 203.0.113.9 / || fail "the client of the probe was let through"
     wait_for "the client's next request did not make its ban permanent" \
-        logged "$DISCRIMINATOR" '"ban_expires":"permanent"'
+        logged "$DISCRIMINATOR" '"action":"permanently_banned"' '"ban_expires":"permanent"'
     echo "example-app: a probe for /.env bans the client, its next request for good"
 
     docker exec "$DISCRIMINATOR" sv stop sww >/dev/null ||
@@ -232,7 +233,7 @@ main() {
     start_app
     refused || fail "the new discriminator container let the banned client through"
     wait_for "discriminator logged no request refused under the ban" \
-        logged "$DISCRIMINATOR" '"action":"banned"'
+        logged "$DISCRIMINATOR" '"action":"temporarily_banned"'
     echo "example-app: a new discriminator container on the same volume keeps the ban"
 
     docker rm --force "$DISCRIMINATOR" >/dev/null